https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 02:24:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55525 <p><strong>Affected:</strong> MervinPraison PraisonAI, MervinPraison praisonaiagents</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI, MervinPraison praisonaiagents</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.</p> https://vulnerability.circl.lu/vuln/cve-2026-55525 https://vulnerability.circl.lu/vuln/pysec-2026-3898 <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>### Summary `web_crawl` (an exported, model-callable tool) validates only the INITIAL URL&#39;s resolved IP against a private/loopback blocklist, then fetches with `httpx.Client(follow_redirects=True)` and never re-validates redirect targets.</p> <p>An attacker who controls the agent&#39;s crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata `169.254.169.254`, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock `pip install praisonaiagents`, so no provider configuration is required.</p> <p>### Details</p> <p>1. The agent is asked (or prompt-injected) to crawl `https://attacker.example/r`, which the source accepts because `attacker.example` resolves to a public IP. 2. The attacker server responds 302 Location: `http://169.254.169.254/latest/meta-data/iam/security-credentials/&lt;role&gt;`. 3. `_crawl_with_httpx` follows the redirect with `follow_redirects=True`, fetches the IAM credential document, and `web_crawl` returns it in the result content field, where it enters the agent context and any downstream tool, log, or model response.</p> <p>The same technique reaches `http://127.0.0.1:&lt;port&gt;/` internal services and other link-lo…</p> <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>### Summary `web_crawl` (an exported, model-callable tool) validates only the INITIAL URL&#39;s resolved IP against a private/loopback blocklist, then fetches with `httpx.Client(follow_redirects=True)` and never re-validates redirect targets.</p> <p>An attacker who controls the agent&#39;s crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata `169.254.169.254`, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock `pip install praisonaiagents`, so no provider configuration is required.</p> <p>### Details</p> <p>1. The agent is asked (or prompt-injected) to crawl `https://attacker.example/r`, which the source accepts because `attacker.example` resolves to a public IP. 2. The attacker server responds 302 Location: `http://169.254.169.254/latest/meta-data/iam/security-credentials/&lt;role&gt;`. 3. `_crawl_with_httpx` follows the redirect with `follow_redirects=True`, fetches the IAM credential document, and `web_crawl` returns it in the result content field, where it enters the agent context and any downstream tool, log, or model response.</p> <p>The same technique reaches `http://127.0.0.1:&lt;port&gt;/` internal services and other link-lo…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3898