MervinPraison PraisonAI 1.5.128-1.6.57 Web Crawl Tools web_crawl_tools.py praisonaiagents.tools.web_crawl_tools.web_crawl url server-side request forgery

Summaryinfo

A vulnerability, which was classified as critical, was found in MervinPraison PraisonAI 1.5.128-1.6.57. This affects the function praisonaiagents.tools.web_crawl_tools.web_crawl of the file praisonaiagents/tools/web_crawl_tools.py of the component Web Crawl Tools. The manipulation of the argument url results in server-side request forgery. This vulnerability was named CVE-2026-55523. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in MervinPraison PraisonAI 1.5.128-1.6.57. Affected is the function praisonaiagents.tools.web_crawl_tools.web_crawl of the file praisonaiagents/tools/web_crawl_tools.py of the component Web Crawl Tools. The manipulation of the argument url with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.web_crawl_tools.web_crawl() function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx fallback uses httpx.Client(follow_redirects=True) and does not revalidate intermediate or final redirect targets. An attacker who can influence a URL passed to web_crawl(), directly or through an agent or tool workflow, can supply an attacker-controlled public URL that passes the initial host check and then redirects to loopback, private-network, or cloud metadata endpoints reachable from the host, with the redirected response body returned in the web_crawl() result. This constitutes an incomplete fix and patch bypass for the previously disclosed web_crawl SSRF class (GHSA-qq9r-63f6-v542 / CVE-2026-40160 and GHSA-8f4v-xfm9-3244), since the guard validates only the requested URL and not the destination actually fetched after redirection. This issue has been fixed in version 1.6.58.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-55523 since 06/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.6.58 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• MervinPraison

Name

• PraisonAI

Version

• 1.5.128-1.6.57

Website

• Product: https://github.com/MervinPraison/PraisonAI/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion