Executive brief
PraisonAI is an AI agent framework that includes tools for crawling web content. A security flaw in its web crawling tool allows an attacker to bypass safety filters and force the application to access internal network services, such as private databases or cloud metadata services. This could lead to the exposure of sensitive internal data or administrative credentials that are not intended to be accessible from the public internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `web_crawl` tool of PraisonAI (specifically the `praisonaiagents` package) due to a Time-of-Check Time-of-Use (TOCTOU) flaw. The `_is_safe_crawl_url` function validates hostnames by resolving them to check for private or loopback IP addresses, but it does not pin the resolved IP. The underlying HTTP clients (httpx, urllib, or crawl4ai) re-resolve the hostname at connection time. An attacker can use a DNS rebinding service to return a public IP during the validation phase and a private/internal IP during the connection phase. This allows the attacker to bypass SSRF protections and read the response bodies from internal services. The issue is fixed in version 1.6.78.
Affected products
- MervinPraison PraisonAI (praisonaiagents) < 1.6.78
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD