CVE-2026-55525

Name of the Vulnerable Software and Affected Versions praisonaiagents versions prior to 1.6.58

Description A Server-Side Request Forgery (SSRF) issue exists in the web crawl tool. The system validates the resolved IP of the initial URL against a blocklist of private and loopback addresses but fails to re-validate targets when following HTTP redirects via the crawl with httpx function. An attacker who can influence the crawl target—through a malicious task or prompt injection—can provide a public URL that redirects to internal resources, such as cloud metadata services (e.g., 169.254.169.254), localhost services, or internal APIs. This allows the attacker to bypass SSRF protections and exfiltrate internal data, including IAM credentials, which are then returned to the agent context.

Recommendations Update praisonaiagents to version 1.6.58. As a temporary workaround, restrict the agent's ability to crawl untrusted or user-influenced URLs until the update is applied.