Injection Vulnerability in PraisonAI Multi-Agent System
CVE-2026-57143

8.8HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonaiagents
Vendor
CVE Published:
12 October 2026

What is CVE-2026-57143?

PraisonAI, a multi-agent teams system, contains an injection vulnerability where the searxng_search and search_web SearxNG provider improperly handle the searxng_url parameter in requests. This failure to validate parameters can lead to prompt-injection attacks, allowing malicious requests to access internal JSON services and test open or closed internal ports. It can also initiate unauthorized cloud-metadata queries, placing sensitive JSON data within agent contexts. The vulnerability has been patched in version 1.6.62.

Affected Version(s)

praisonaiagents < 1.6.62

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM
https://github.com/MervinPraison/PraisonAI/commit/2a855c4...
x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.