EUVD-2026-77542
GHSA-vxgj-xg5c-p4h7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
PR:L reflects required account access; S:C and C:H capture internal-service response exfiltration; I:L covers SSRF-triggered state changes; A:N as availability is unaffected.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.
AnalysisAI
Server-Side Request Forgery in PraisonAI's multi-agent web tooling allows an authenticated user to exfiltrate internal service responses by supplying a hostname whose DNS A record resolves to a loopback, RFC-1918, link-local, or cloud-metadata address. The SSRF guard in SpiderTools._validate_url → _host_is_blocked inspects only literal IP encodings and silently falls through for any DNS hostname, meaning a static internal A record is sufficient - no DNS rebinding race is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) PR:L - the attacker must hold at least a low-privilege account or API key that allows submitting tasks or URL inputs to the PraisonAI multi-agent system; (2) control or registration of an external DNS hostname whose A/AAAA record resolves to a blocked address class (loopback 127.0.0.0/8, RFC-1918 private, link-local 169.254.x.x, or IPv6 link-local/loopback); (3) the target internal address must be reachable from the PraisonAI server process - most impactful when a cloud metadata endpoint (169.254.169.254) or a private-network service is available. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, score 8.5) is broadly accurate: network-reachable, low complexity, requires low privileges (access to submit agent tasks), no user interaction, and scope change to internal systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade `praisonaiagents` to version 1.6.59 (or the outer `PraisonAI` package to 4.6.58) via `pip install --upgrade praisonaiagents`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments running praisonaiagents up to version 1.6.48 and assess which user accounts have access to SSRF-vulnerable scrape_page, crawl, extract_links, extract_text, and @url features. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the appl
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today