CVE-2026-47395 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context
Attacker-controlled prompt text triggers automatic URL fetching, allowing access to internal loopback resources and injecting data into model context.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47395?
CVE-2026-47395 is a medium-severity server-side request forgery vulnerability in MervinPraison PraisonAI, published on 21 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins. If a prompt contains `@url:<http-or-https-url>`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch. As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a fix.
Weakness: CWE-200
Which versions are affected by CVE-2026-47395?
6 open source packages ship an affected version, including praisonaiagents, PraisonAI and praisonai.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.6.40 |
praisonaiagents PyPI | All versions | 1.6.40 |
praisonaiagents PyPI | All versions | 1.6.40 |
PraisonAI PyPI | All versions | 4.6.40 |
praisonai PyPI | All versions | 4.6.40 |
praisonai PyPI | All versions | 4.6.40 |
How do I fix CVE-2026-47395?
Upgrade praisonaiagents to 1.6.40 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-47395 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47395 exists.
Sources
Also known as GHSA-5cxw-77wg-jrf3, PYSEC-2026-2903, PYSEC-2026-2942.