https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 21:07:10 +0000 https://db.gcve.eu/vuln/cve-2026-61430 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.</p> https://db.gcve.eu/vuln/cve-2026-61430 https://db.gcve.eu/vuln/pysec-2026-4272 <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>## Summary</p> <p>PraisonAI&#39;s `web_crawl` agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by `_is_safe_crawl_url()`, which resolves the hostname and rejects private/loopback/link-local IPs **at validation time**. The validated value is the URL *string* (not a pinned IP); the fetch backend then **re-resolves the hostname at connection time**. Because validation and connection perform two independent DNS resolutions, a **DNS-rebinding** domain that returns a public IP during validation and an internal IP during the fetch fully bypasses the guard, and the internal HTTP response body is returned to the caller.</p> <p>This is **SSRF with internal response disclosure (read-back)** — not blind SSRF. Runtime-confirmed against PraisonAI 4.6.63; the crawl response returned the controlled internal markers `PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91` / `FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91`. Severity High. Reachable by any actor who can influence the URL an agent crawls (e.g. a chat/bot/agent surface).</p> <p>## Details</p> <p>### Affected component - Package: `praisonaiagents` (PraisonAI), version **4.6.63**. - File: `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py`; tool `web_crawl` / `crawl_web` (part of the default bot tool set).</p> <p>### Vulnerable code / root cause</p> <p>**Code point 1 — check-time-only DNS validation, no IP pinning**</p> <p>Path: `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py`</p> <p>Function: `_is_safe_crawl_url`</p> <p>S…</p> <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>## Summary</p> <p>PraisonAI&#39;s `web_crawl` agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL. SSRF is meant to be prevented by `_is_safe_crawl_url()`, which resolves the hostname and rejects private/loopback/link-local IPs **at validation time**. The validated value is the URL *string* (not a pinned IP); the fetch backend then **re-resolves the hostname at connection time**. Because validation and connection perform two independent DNS resolutions, a **DNS-rebinding** domain that returns a public IP during validation and an internal IP during the fetch fully bypasses the guard, and the internal HTTP response body is returned to the caller.</p> <p>This is **SSRF with internal response disclosure (read-back)** — not blind SSRF. Runtime-confirmed against PraisonAI 4.6.63; the crawl response returned the controlled internal markers `PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91` / `FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91`. Severity High. Reachable by any actor who can influence the URL an agent crawls (e.g. a chat/bot/agent surface).</p> <p>## Details</p> <p>### Affected component - Package: `praisonaiagents` (PraisonAI), version **4.6.63**. - File: `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py`; tool `web_crawl` / `crawl_web` (part of the default bot tool set).</p> <p>### Vulnerable code / root cause</p> <p>**Code point 1 — check-time-only DNS validation, no IP pinning**</p> <p>Path: `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py`</p> <p>Function: `_is_safe_crawl_url`</p> <p>S…</p> https://db.gcve.eu/vuln/pysec-2026-4272