Executive brief
PraisonAI is a framework for building autonomous AI agents. A security flaw in its web-crawling and URL-fetching tools allows attackers to bypass security filters intended to protect internal networks. By using a domain name that points to a private IP address, an attacker can trick the AI agent into accessing sensitive internal services or cloud metadata, potentially leading to the exposure of private data or infrastructure credentials.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `SpiderTools._validate_url` and `_host_is_blocked` functions within `praisonaiagents/tools/spider_tools.py`. The current implementation only checks if the literal URL string is a blocked IP address (e.g., '127.0.0.1') but fails to resolve DNS hostnames before validation. An attacker can provide a hostname (e.g., 'attacker.com') that resolves to a loopback, private, or cloud metadata address (169.254.169.254). Because the guard returns 'False' (not blocked) for any string it cannot parse as a literal IP, the subsequent fetch via `requests` or `urllib` proceeds to the internal target. This affects tools like `scrape_page`, `crawl`, and `@url` mentions. A fix involves resolving the hostname using `socket.getaddrinfo` and validating every returned IP address.
Affected products
- MervinPraison praisonaiagents <= 1.6.39
- MervinPraison PraisonAI <= 4.6.39
Timeline
- 2026-06-17: disclosed
- 2026-06-18: advisory