CVE-2026-34954 - Vulnerability Analysis

Overview

PraisonAI < 1.5.95 contains a server-side request forgery caused by lack of validation on the url parameter in FileTools.download_file(), letting attackers access internal or cloud metadata services, exploit requires attacker-controlled URL.

Severity & Score

Impact

Attackers can access internal network or cloud metadata services, potentially leading to sensitive information disclosure or further network compromise.

Mitigation

Update to version 1.5.95 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-44c2-3rw4-5gvh

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner