CVE-2026-57143

{
  "etk_id": "ETK-2026-1407",
  "cve_id": "CVE-2026-57143",
  "display_id": "CVE-2026-57143",
  "ghsa_id": "GHSA-4pcv-mg8v-vrgf",
  "euvd_id": "EUVD-2026-97773",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SSRF in praisonaiagents SearxNG search tools",
  "summary": "praisonaiagents versions before 1.6.62 allow the SearxNG endpoint used by search tools to be controlled through agent input. An attacker who can influence content processed by an agent may induce requests to internal HTTP services and expose returned JSON data to the agent.",
  "mitigation": "Upgrade praisonaiagents to version 1.6.62 or later. Until the upgrade is complete, disable the SearxNG-backed search tools for agents that process untrusted content.",
  "vendor": "MervinPraison",
  "product": "praisonaiagents",
  "affected": [
    {
      "affected_notes": [
        "< current latest release"
      ],
      "affected_ranges": [],
      "ecosystem": "pip",
      "fixed_versions": [
        ">= 1.6.61"
      ],
      "package_name": "praisonaiagents",
      "purl": "pkg:pypi/praisonaiagents"
    }
  ],
  "cwes": [
    20
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
  "epss_score": 0.0022,
  "epss_percentile": 0.1203,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 15.930667633333334,
  "t0_at": "2026-10-12T18:48:00.429000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T19:40:10.141111+00:00",
      "days": 0.03622351980324074,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T18:48:00.429000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-12T18:48:00.429000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T18:48:00.429000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57143"
    }
  }
}