EUVD-2026-65499
GHSA-x44h-65qv-cw74
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-reachable via agent prompt; low privilege required to instruct the agent; scope change because internal host services are affected beyond the application boundary; high confidentiality as full internal responses are returned; low integrity since exploitation relies on HTTP GET semantics.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.
AnalysisAI
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users route agent web-fetching functions to internal HTTP services by supplying hostnames - such as 127.0.0.1.nip.io - that pass the static IP blocklist in spider_tools._host_is_blocked() because the function never performs DNS resolution before validation. The affected functions scrape_page, extract_links, crawl, and extract_text are registered as default LLM-callable agent tools, so any agent prompted to retrieve a user-supplied URL will trigger this path; a live proof-of-concept is documented in the GitHub Security Advisory (GHSA-x44h-65qv-cw74), confirming that publicly available exploit code exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have low-privileged access sufficient to supply a URL to a PraisonAI agent that invokes one of the affected LLM-callable tools: scrape_page, extract_links, crawl, or extract_text - all registered as default agent tools via tools/__init__.py lines 51-55. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.5 score is well-supported: the network attack vector (AV:N), low complexity (AC:L), and low-privilege requirement (PR:L) combine with a scope change (S:C) that elevates the effective impact beyond the praisonaiagents process to internal network services. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privileged access to a PraisonAI deployment - for example, a user who can supply prompts to an agent using the scrape_page or crawl tools - provides a URL such as http://127.0.0.1.nip.io:8080/admin/config. The SSRF filter in _host_is_blocked() treats '127.0.0.1.nip.io' as an ordinary hostname, fails to resolve it, and returns False, permitting the HTTP request to proceed to the local service; the GHSA advisory confirms this exact scenario with a live exploit requiring no external infrastructure. … |
| Remediation | Upgrade praisonaiagents to version 1.6.58 or later via pip install --upgrade praisonaiagents; the vendor-released patch is confirmed by GitHub release tag v4.6.58 and commit 2f9677abb2ea68eab864ee8b6a828fd0141612e1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, create an inventory of all systems using praisonaiagents, document deployed versions, and identify those with access to internal APIs or cloud metadata services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by
Remote code execution in PraisonAI before 1.6.78 allows attackers to run arbitrary Python on the host by manipulating th
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source f
Unauthenticated remote command execution in PraisonAI's bundled Claude GitHub Actions workflow (versions before 4.6.40)
Root-level command execution and arbitrary file write in PraisonAI's AICoder component (all versions before 4.6.78) let
Path traversal in PraisonAI multi-agent teams system (versions prior to 4.5.128) enables arbitrary file overwrite throug
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today