CVE-2026-55523

Name of the Vulnerable Software and Affected Versions PraisonAI versions 1.5.128 through 1.6.57

Description The web crawl() function in praisonaiagents.tools.web crawl tools is susceptible to server-side request forgery (SSRF). Although the system validates the initial URL to block direct loopback and private destinations, the default httpx fallback uses httpx.Client(follow redirects=True) without revalidating intermediate or final redirect targets. An attacker can provide a public URL that passes the initial check and then redirects to loopback, private-network, or cloud metadata endpoints reachable from the host. The response body from these restricted destinations is then returned in the web crawl() result. This issue affects the web crawl() and crawl with httpx() functions.

Recommendations Update PraisonAI to version 1.6.58. As a temporary workaround, restrict the use of the web crawl() function or avoid passing user-influenced URLs to it until the update is applied.