CVE-2026-34954: PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL

April 1, 2026 (updated April 6, 2026)

FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services.

References

github.com/MervinPraison/PraisonAI
github.com/MervinPraison/PraisonAI/security/advisories/GHSA-44c2-3rw4-5gvh
github.com/advisories/GHSA-44c2-3rw4-5gvh
nvd.nist.gov/vuln/detail/CVE-2026-34954

Code Behaviors & Features

Detect and mitigate CVE-2026-34954 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →