Executive brief
PraisonAI is a multi-agent AI system that includes web scraping and data extraction tools. A vulnerability in its URL validation allows attackers to bypass security policies and access internal services (such as cloud metadata endpoints or loopback services) by providing hostnames that resolve to private IP addresses, potentially exposing sensitive internal data to unauthorized access.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) bypass in SpiderTools._validate_url. The _host_is_blocked function performs only literal hostname checks but does not resolve DNS names before making requests via scrape_page, crawl, extract_links, extract_text, or URL-mention fetches. An attacker can provide a domain name that resolves to loopback, private, link-local, or cloud-metadata addresses, bypassing the SSRF policy without requiring a rebinding race condition. This allows exposure of internal HTTP responses to the agent. The vulnerability affects praisonaiagents versions prior to 1.6.58, with a fix committed on 2026-06-13.
Affected products
- PraisonAI praisonaiagents prior to 1.6.58
Timeline
- 2026-09-14: disclosed
- 2026-06-13: patched: Fix committed; version 1.6.58 released