PT-2026-61769 · Praisonai · Praisonai
CVE-2026-57115
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PraisonAI versions 3.9.24 through 4.6.57
Description
Server-Side Request Forgery (SSRF) is possible in the
SpiderTools.scrape page() function, which is also utilized by extract links(), crawl(), and extract text(). While the software validates the initial URL to block loopback, private, link-local, and internal hostnames, it fails to disable automatic redirects or validate the Location targets of those redirects. An attacker can provide a public URL that passes initial validation but redirects to a blocked internal target, such as 127.0.0.1 or 169.254.169.254, allowing the response body of the internal service to be returned to the attacker.Recommendations
For versions 3.9.24 through 4.6.57, disable automatic redirects in the
scrape page() function by setting allow redirects=False in the session.get() call.As a temporary mitigation, restrict the use of the
scrape page(), extract links(), crawl(), and extract text() functions to trusted inputs only.Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Praisonai