PraisonAI EUVD-2026-65499

The attacker must have low-privileged access sufficient to supply a URL to a PraisonAI agent that invokes one of the affected LLM-callable tools: scrape_page, extract_links, crawl, or extract_text - all registered as default agent tools via tools/__init__.py lines 51-55. The target must be running praisonaiagents prior to version 1.6.58. No non-default configuration is required; the vulnerable code path is active by default whenever spider_tools are loaded. Exploitation is bounded to reading internal HTTP services reachable on loopback or private network addresses from the host running praisonaiagents - it does not inherently grant code execution. The integrity impact is limited to HTTP GET semantics unless internal services accept state-changing GET requests.

The CVSS 8.5 score is well-supported: the network attack vector (AV:N), low complexity (AC:L), and low-privilege requirement (PR:L) combine with a scope change (S:C) that elevates the effective impact beyond the praisonaiagents process to internal network services. The high confidentiality rating (C:H) is credible given that internal service responses - potentially including cloud instance metadata, internal API credentials, or microservice data - are returned directly to the attacker. No EPSS data was provided in the input, and this CVE is not listed in CISA KEV, so wide automated exploitation has not been confirmed; however, the GHSA advisory documents a live proof-of-concept requiring zero external infrastructure, which dramatically lowers the exploitation bar compared to a theoretical flaw. The PR:L metric accurately reflects that an attacker must have some access to instruct a PraisonAI agent; unauthenticated exploitation is not indicated by the CVSS vector. The integrity impact is correctly rated low (I:L) since HTTP GET semantics do not inherently mutate state, though internal services accepting state-changing GETs would extend that impact. Operators with sensitive services on loopback or RFC-1918 addresses should prioritize patching regardless of the absence of a KEV listing, given the trivial exploitation technique and confirmed proof-of-concept.

An attacker with low-privileged access to a PraisonAI deployment - for example, a user who can supply prompts to an agent using the scrape_page or crawl tools - provides a URL such as http://127.0.0.1.nip.io:8080/admin/config. The SSRF filter in _host_is_blocked() treats '127.0.0.1.nip.io' as an ordinary hostname, fails to resolve it, and returns False, permitting the HTTP request to proceed to the local service; the GHSA advisory confirms this exact scenario with a live exploit requiring no external infrastructure. The agent returns the internal service response to the attacker, potentially exposing secrets, API keys, or cloud metadata credentials.