https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:13:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-55526 <p><strong>Affected:</strong> MervinPraison PraisonAI, MervinPraison praisonaiagents</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI, MervinPraison praisonaiagents</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.</p> https://vulnerability.circl.lu/vuln/cve-2026-55526 https://vulnerability.circl.lu/vuln/pysec-2026-3905 <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>### Summary</p> <p>`praisonaiagents/tools/spider_tools.py` contains an SSRF protection bypass. The function `_host_is_blocked()` validates URLs against a list of blocked IP literals and hostname aliases, but **never performs DNS resolution**. Any hostname that resolves to a private or loopback IP address — including public wildcard DNS services like `127.0.0.1.nip.io` — bypasses the protection entirely.</p> <p>This has been **confirmed with a live exploit**: `scrape_page(&#34;http://127.0.0.1.nip.io:PORT/secret&#34;)` makes an HTTP request to `127.0.0.1:PORT` and returns the internal service response. No attacker-controlled infrastructure is required.</p> <p>`scrape_page`, `extract_links`, `crawl`, and `extract_text` are all registered as LLM-callable agent tools (see `tools/__init__.py` lines 51-55), so any agent instructed to fetch a user-supplied URL will trigger this path.</p> <p>This is a **new bypass** of prior fix commit `004dcfef` (GHSA-q9pw-vmhh-384g), which only rejected IP literal encoding tricks (hex, octal, backslash). The fix was also applied to `web_crawl_tools.py` (line 231: `socket.gethostbyname` call), but that fix was not ported to `spider_tools.py`.</p> <p>### Details</p> <p>**Root cause — `spider_tools.py` lines 26-65:**</p> <p>```python def _host_is_blocked(hostname: str) -&gt; bool: host = hostname.lower().rstrip(&#34;.&#34;) # Checks literal aliases only — never resolves if host in (&#34;localhost&#34;, &#34;0.0.0.0&#34;, &#34;::1&#34;): return True if host in (&#34;169.254.169.254&#34;, &#34;metadata.google.internal&#34;):…</p> <p><strong>Affected:</strong> PyPI: praisonaiagents</p> <p>### Summary</p> <p>`praisonaiagents/tools/spider_tools.py` contains an SSRF protection bypass. The function `_host_is_blocked()` validates URLs against a list of blocked IP literals and hostname aliases, but **never performs DNS resolution**. Any hostname that resolves to a private or loopback IP address — including public wildcard DNS services like `127.0.0.1.nip.io` — bypasses the protection entirely.</p> <p>This has been **confirmed with a live exploit**: `scrape_page(&#34;http://127.0.0.1.nip.io:PORT/secret&#34;)` makes an HTTP request to `127.0.0.1:PORT` and returns the internal service response. No attacker-controlled infrastructure is required.</p> <p>`scrape_page`, `extract_links`, `crawl`, and `extract_text` are all registered as LLM-callable agent tools (see `tools/__init__.py` lines 51-55), so any agent instructed to fetch a user-supplied URL will trigger this path.</p> <p>This is a **new bypass** of prior fix commit `004dcfef` (GHSA-q9pw-vmhh-384g), which only rejected IP literal encoding tricks (hex, octal, backslash). The fix was also applied to `web_crawl_tools.py` (line 231: `socket.gethostbyname` call), but that fix was not ported to `spider_tools.py`.</p> <p>### Details</p> <p>**Root cause — `spider_tools.py` lines 26-65:**</p> <p>```python def _host_is_blocked(hostname: str) -&gt; bool: host = hostname.lower().rstrip(&#34;.&#34;) # Checks literal aliases only — never resolves if host in (&#34;localhost&#34;, &#34;0.0.0.0&#34;, &#34;::1&#34;): return True if host in (&#34;169.254.169.254&#34;, &#34;metadata.google.internal&#34;):…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3905