Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-03 | 1 | Patch1 |
| 2026-04-04 | 1 | Disclosure1 |
| 2026-04-14 | 1 | Disclosure1 |
[CVE-2026-34954: HIGH] PraisonAI patch 1.5.95 fixes critical security flaw in http://FileTools.download_file(). Ensure systems are updated to prevent potential cyber attacks via malicious URLs.#cve,CVE-2026-34954,#cybersecurity https://cvefind.com/CVE-2026-34954
Post summary
The post announces a patch (PremiereAI 1.5.95) for CVE‑2026‑34954 and urges updates to prevent potential attacks.
```json { "x": "🚨 HIGH: CVE-2026-34954 (CVSS 8.6) - SSRF in PraisonAI multi-agent system allows attackers to reach cloud metadata & internal services via unvalidated URLs. Patch to v1.5.95+ immediately. https://t.co/mCmojsPIwc
Post summary
The post announces a high‑severity SSRF vulnerability (CVE‑2026‑34954, CVSS 8.6) in PraisonAI's multi‑agent system, urges users to update to v1.5.95+, and provides technical details but no PoC or active exploitation evidence.
🟠 CVE-2026-34954 - High PraisonAI is a multi-agent teams system. Prior to version 1.5.95, http://FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, ... https://www.thehackerwire.com/vulnerability/CVE-2026-34954/ https://t.co/1s0JIonLap
Post summary
The post discloses that CVE-2026-34954 affects PriasonAI’s FileTools.download_file() by lacking URL validation, presenting a vulnerability. No PoC, exploit code, patch, or evidence of active exploitation is mentioned.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | praison | praisonaiagents | - | - | - |