CVE-2026-55523 — PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets

Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx fallback uses httpx.Client(follow_redirects=True) and does not revalidate intermediate or final redirect targets. An attacker who can influence a URL passed to web_crawl(), directly or through an agent or tool workflow, can supply an attacker-controlled public URL that passes the initial host check and then redirects to loopback, private-network, or cloud metadata endpoints reachable from the host, with the redirected response body returned in the web_crawl() result. This constitutes an incomplete fix and patch bypass for the previously disclosed web_crawl SSRF class (GHSA-qq9r-63f6-v542 / CVE-2026-40160 and GHSA-8f4v-xfm9-3244), since the guard validates only the requested URL and not the destination actually fetched after redirection. This issue has been fixed in version 1.6.58.

GHSA-8hjw-25cg-g52h — praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Affected: PyPI: praisonaiagents

## Summary

`praisonaiagents.tools.web_crawl_tools.web_crawl()` validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses `httpx.Client(follow_redirects=True)` and does not revalidate redirect targets.

An attacker-controlled public URL can pass the initial host check, redirect to loopback/private/cloud metadata infrastructure, and have the redirected response body returned by `web_crawl()`.

This appears to be an incomplete fix / patch bypass for the published `web_crawl` SSRF class (`GHSA-qq9r-63f6-v542` / `CVE-2026-40160`, and `GHSA-8f4v-xfm9-3244`).

## Affected Component

Package:

```text praisonaiagents ```

File:

```text src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py ```

Functions:

```text web_crawl() _crawl_with_httpx() ```

## Affected Versions

Validated affected:

- `praisonaiagents 1.5.128` via repository tag `v4.5.128`; - `praisonaiagents 1.6.40` via repository tag `v4.6.40`; - `praisonaiagents 1.6.56` via repository tag `v4.6.56`; - current `origin/main` commit `095653d78a01cc6c80ff5b2dd20a8e5619686ddc`.

Suggested affected range for maintainer confirmation:

```text >= 1.5.128, <= 1.6.56 ```

No patched version is known to me at submission time.

## Root Cause

Current `web_crawl()` validates only the initially supplied URL:

- requires `http` or `https`; - resolves the initial hostname with `socket.gethostbyname()`; - rejects loopback/private/link-local/multicast/unspecif…

Most recent entries from all

CVE-2026-55523 — PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets

GHSA-8hjw-25cg-g52h — praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets