CVE-2026-57115: PraisonAI: SpiderTools redirect-target SSRF protection bypass
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrapepage validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrapepage and its extractlinks, crawl, and extracttext callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
praisonaiagentsto a version that resolves this vulnerability.Fixed in 1.6.59
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using praisonaiagents versions prior to 1.6.59 are affected where untrusted or attacker-influenced URLs can reach SpiderTools.scrape_page or callers including extract_links, crawl, and extract_text.
What does an attacker need to exploit this issue?
An attacker needs a victim to cause the affected functionality to request a public-looking URL that redirects to a loopback, private, link-local, or metadata address. No attacker privileges are required, but user interaction is required according to the supplied severity vector.
What can be exposed through a successful exploit?
The response body from the redirected internal service can be returned by scrape_page and by its extract_links, crawl, and extract_text callers, allowing disclosure of data from services that the initial URL validation would otherwise block.
How can the issue be remediated?
Upgrade praisonaiagents to version 1.6.59, which fixes the redirect-target validation bypass.