Executive brief
PraisonAI, a system for managing multi-agent AI teams, contains a security flaw in its web-scraping tools. The system attempts to prevent agents from accessing internal or private network services, but this protection can be bypassed using specially formatted web addresses. An attacker could exploit this to force the AI system to interact with sensitive internal services that are not intended to be accessible from the outside, potentially leading to unauthorized data access.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `spider_tools` component of PraisonAI due to insufficient URL validation. The `_validate_url` function in `praisonaiagents/tools/spider_tools.py` utilizes a weak blocklist that only checks for exact host strings like 'localhost' and '127.0.0.1'. It fails to perform DNS resolution, hostname normalization, or validation of numeric IPv4 variants (such as octal, hexadecimal, or dword formats). Consequently, an attacker can bypass these checks using encodings like `http://127.1` or `http://0x7f000001` to reach loopback-only services. Once validation is bypassed, `scrape_page()` executes a request via `requests.Session.get()`. The issue is addressed in PraisonAI version 4.6.40 and praisonaiagents version 1.6.40.
Affected products
- MervinPraison PraisonAI < 4.6.40
- MervinPraison praisonaiagents < 1.6.40
Timeline
- 2026-05-19: patched: Fixes merged in GitHub PR #1684
- 2026-07-21: disclosed: CVE-2026-47390 published