CVE-2026-47395

CVE-2026-47395 – PraisonAI CLI loopback/SSRF via @url: mentions Prior to PraisonAI v4.6.40 (and praisonaiagents v1.6.40), the direct-prompt CLI automatically expands @url:(http|https) prompts, performing an unrestricted urllib.request.urlopen() to the attacker-controlled URL. The fetched response...

PT-2026-45054

Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description The direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution. The MentionsParser.process function handles these mentions by performing a direct HTTP...