PraisonAIAgents before version 1.5.128 contains an SSRF vulnerability (CWE-918) in its web_crawl httpx fallback path. The issue is that user-supplied URLs are passed directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation, enabling an attacker to coerce an LLM agent into accessing internal network resources such as cloud metadata endpoints and localhost. The response from these internal requests is returned to the agent and may be visible to an attacker. This fallback path is the default on fresh installations without certain keys or modules. The vulnerability is addressed in version 1.5.128.

An attacker can exploit this SSRF vulnerability to make the vulnerable PraisonAIAgents instance send HTTP requests to internal network resources, including cloud metadata services and localhost. This can lead to unauthorized disclosure of sensitive internal information. The response content from these internal requests may be exposed to the attacker via the agent's output. There is no indication of privilege escalation or remote code execution from the provided data. No known exploits in the wild have been reported.

Upgrade PraisonAIAgents to version 1.5.128 or later, where this SSRF vulnerability is fixed. Since no official remediation level or patch link is provided, verify the upgrade availability from the vendor or official sources. Avoid using the default httpx fallback path without host validation. Patch status is not yet confirmed beyond the stated fix version—check the vendor advisory for current remediation guidance.