Executive brief
PraisonAI is an AI agent framework that includes tools for crawling and analyzing web content. A security flaw in its web crawling component allows attackers to trick the system into accessing internal company servers and private data that should be unreachable from the internet. This could lead to the exposure of sensitive internal information, cloud metadata, or configuration secrets, potentially giving an attacker a foothold in the corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `web_crawl` tool of PraisonAI when using the Crawl4AI/Chromium backend. The root cause is a Time-of-Check Time-of-Use (TOCTOU) flaw where the initial URL validation check (`_is_safe_crawl_url`) is performed, but the subsequent headless Chromium browser session re-resolves DNS and follows redirects independently without per-connection validation or IP pinning. An attacker with low privileges can exploit this via DNS rebinding or HTTP redirects to bypass the blocklist and read responses from internal services or cloud metadata endpoints. The vulnerability is addressed in version 1.6.78.
Affected products
- MervinPraison PraisonAI (praisonaiagents) < 1.6.78
Timeline
- 2026-06-25: advisory: Vendor advisory published on GitHub
- 2026-07-11: disclosed: NVD publication date