PraisonAI versions before 1.5.95 contain an SSRF vulnerability (CWE-918) in the FileTools.download_file() function within the praisonaiagents component. The function fails to validate the URL parameter before passing it to httpx.stream() with follow_redirects set to true, enabling an attacker to induce the server to send HTTP requests to arbitrary internal or external hosts accessible from the server environment. This can lead to unauthorized access to internal services or sensitive metadata endpoints. The vulnerability is addressed by an update to version 1.5.95 that includes proper validation or mitigation of the URL parameter.

An attacker can exploit this SSRF vulnerability to make the vulnerable server send HTTP requests to arbitrary hosts accessible from the server, including internal network services and cloud metadata services. This can result in unauthorized information disclosure from internal systems. The CVSS score of 8.6 (high severity) reflects the potential for high confidentiality impact without requiring authentication or user interaction. There is no indication of known exploits in the wild at this time.

A patch is available in PraisonAI version 1.5.95 that fixes this vulnerability. Users should upgrade to version 1.5.95 or later to remediate this issue. No other mitigation guidance is provided or required as the vendor advisory confirms the issue is fixed in this version.