GHSA-4pcv-mg8v-vrgf

### Summary A Server-Side Request Forgery (SSRF) vulnerability in the SearxNG / `search_web` search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The `searxng_url` argument is passed directly to `requests.get()` with no validation of scheme, host, or port. Because `searxng_url` is exposed to the LLM as a tool parameter and `search_web` / `searxng_search` are part of the default agent toolset, the vulnerability is reachable through prompt injection in any content an agent ingests (web pages, files, tool output). This enables reading internal services and APIs, internal host/port enumeration, and in cloud environments reachability of the instance metadata endpoint (169.254.169.254) with potential IAM/credential exposure. ### Details The SearxNG search provider performs no validation on the `searxng_url` argument before issuing the HTTP request. `src/praisonai-agents/praisonaiagents/tools/searxng_tools.py` (lines 16–47): ```python def searxng_search( query: str, max_results: int = 5, searxng_url: Optional[str] = None ) -> List[Dict]: ... url = searxng_url or "http://localhost:32768/search" # line 42 params = { 'q': query, 'format': 'json', ... } response = requests.get(url, params=params, timeout=10) # line 45 — no validation response.raise_for_status() ``` The same unvalidated pattern exists in the unified `search_web` dispatcher: `src/praisonai-agents/praisonaiagents/tools/web_search.py` (lines 235–247): ```python def _search_searxng(query: str, max_results: int = 5, searxng_url: Optional[str] = None): ... url = searxng_url or os.environ.get("SEARXNG_URL", "http://localhost:32768/search") # line 239 ... response = requests.get(url, params=params, timeout=10) # line 247, no validation ``` `searxng_url` is accepted as a parameter on the public `search_web()` entry point (`web_search.py`, line 277) and i