CVE-2026-34954 PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL

What is CVE-2026-34954?

CVE-2026-34954 is a high-severity vulnerability in MervinPraison PraisonAI, published on 3 Apr 2026.

Official description

PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.

Weakness: CWE-918

Which versions are affected by CVE-2026-34954?

3 open source packages ship an affected version, including praisonaiagents. It affects 1 product.

Products include Praison Praisonaiagents.

How do I fix CVE-2026-34954?

Upgrade praisonaiagents to 1.5.95 or later.

Is CVE-2026-34954 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34954 exists.

Other vulnerabilities in MervinPraison PraisonAI

• CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code Critical 10.0
• CVE-2026-40111 PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) Critical 9.3
• CVE-2026-34937 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution High 7.8
• CVE-2026-44335 SSRF bypass in PraisonAI High 7.7
• CVE-2026-40150 PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-44c2-3rw4-5gvh, PYSEC-2026-2940.