What happened
PraisonAI's default search tool SSRF comes from passing the LLM-controlled searxng_url to requests.get with no scheme/host/port/resolved-address validation. An attacker who can get malicious text into the model's context (via prompt injection) can redirect the agent's search to internal hosts and the cloud metadata service, with responses fed directly back into the agent's context for further action.
Why it matters
This turns a prompt-injection foothold into a network reconnaissance and metadata-exposure primitive against the host running the agent: internal service probing, SSRF reads, and cloud IAM credential exposure through the metadata endpoint — all from unvalidated LLM input.
Attack vector
searxng_search and search_web pass the LLM-controlled searxng_url parameter directly to requests.get without validating scheme, host, port, or resolved address. Prompt-injected content directs the search tool to internal JSON services, probes open vs closed internal ports, and attempts cloud-metadata requests; returned JSON lands in agent context.
Affected systems
PraisonAI praisonaiagents < 1.6.62 (searxng_search tool and search_web SearxNG provider)
Mitigation
Upgrade to praisonaiagents 1.6.62 (commit 2a855c470077c7d2e2479a575f7ef7f548d51c33; GHSA-4pcv-mg8v-vrgf). Validate/resolve searxng_url scheme, host, and address before issuing requests.