PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`) (MervinPraison PraisonAI)
En bref
- Source
- NVD
- EPSS
- EPSS 0.36 % · centile 29 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Deferred
Rechercher sur…
Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.
Faiblesses (CWE)
- CWE-350 — Reliance on Reverse DNS Resolution for a Security-Critical Action
- CWE-918 — Falsification de requête côté serveur (SSRF)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N | GitHub_M |
| CVSS 3.1 | HIGH 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
Avis
- GHSA-x44h-65qv-cw74 — praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
- PYSEC-2026-3905 — praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
Références européennes
- ENISA EUVD · EUVD-2026-65499
- GCVE · GCVE-0-2026-55526
Produits affectés
| Produit | Versions |
|---|---|
| MervinPraison · PraisonAI | affected < 4.6.58 |
| MervinPraison · praisonaiagents | affected < 1.6.58 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |