PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.

Affected: PyPI: praisonaiagents

### Summary A Server-Side Request Forgery (SSRF) vulnerability in the SearxNG / `search_web` search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The `searxng_url` argument is passed directly to `requests.get()` with no validation of scheme, host, or port. Because `searxng_url` is exposed to the LLM as a tool parameter and `search_web` / `searxng_search` are part of the default agent toolset, the vulnerability is reachable through prompt injection in any content an agent ingests (web pages, files, tool output). This enables reading internal services and APIs, internal host/port enumeration, and in cloud environments reachability of the instance metadata endpoint (169.254.169.254) with potential IAM/credential exposure.

### Details

The SearxNG search provider performs no validation on the `searxng_url` argument before issuing the HTTP request.

`src/praisonai-agents/praisonaiagents/tools/searxng_tools.py` (lines 16–47): ```python def searxng_search( query: str, max_results: int = 5, searxng_url: Optional[str] = None ) -> List[Dict]: ... url = searxng_url or "http://localhost:32768/search" # line 42

params = { 'q': query, 'format': 'json', ... }

response = requests.get(url, params=params, timeout=10) # line 45 — no validation response.raise_for_status() ```

The same unvalidated pattern exists in the unified `search_web` dispatcher:

`…

Affected: PyPI: praisonaiagents

### Summary A Server-Side Request Forgery (SSRF) vulnerability in the SearxNG / `search_web` search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The `searxng_url` argument is passed directly to `requests.get()` with no validation of scheme, host, or port. Because `searxng_url` is exposed to the LLM as a tool parameter and `search_web` / `searxng_search` are part of the default agent toolset, the vulnerability is reachable through prompt injection in any content an agent ingests (web pages, files, tool output). This enables reading internal services and APIs, internal host/port enumeration, and in cloud environments reachability of the instance metadata endpoint (169.254.169.254) with potential IAM/credential exposure.

### Details

The SearxNG search provider performs no validation on the `searxng_url` argument before issuing the HTTP request.

`src/praisonai-agents/praisonaiagents/tools/searxng_tools.py` (lines 16–47): ```python def searxng_search( query: str, max_results: int = 5, searxng_url: Optional[str] = None ) -> List[Dict]: ... url = searxng_url or "http://localhost:32768/search" # line 42

params = { 'q': query, 'format': 'json', ... }

response = requests.get(url, params=params, timeout=10) # line 45 — no validation response.raise_for_status() ```

The same unvalidated pattern exists in the unified `search_web` dispatcher:

`…