PraisonAI versions before 4.5.128 contain an SSRF vulnerability (CWE-918) in the /api/v1/runs endpoint. This endpoint accepts a webhook_url parameter in the request body without validating the URL. Upon job completion, the server makes an HTTP POST request to the provided URL using httpx.AsyncClient. Because the URL is not validated and the endpoint is unauthenticated, attackers can induce the server to send requests to arbitrary internal or external destinations, potentially accessing sensitive internal resources such as cloud metadata services or internal APIs. The vulnerability is addressed in version 4.5.128.

An unauthenticated attacker can exploit this vulnerability to make the PraisonAI server send HTTP POST requests to arbitrary URLs, including internal network services. This could lead to unauthorized access to internal resources, information disclosure, or interaction with cloud metadata services, which may expose sensitive data or credentials. The CVSS score of 7.2 reflects a high severity impact with low attack complexity and no privileges required.

Upgrade PraisonAI to version 4.5.128 or later, where this SSRF vulnerability is fixed. Since the fix is included in this version, applying the official update is the recommended remediation. Patch status is not explicitly stated beyond the fix in 4.5.128, so users should verify with the vendor advisory for the latest remediation guidance.