CVE-2026-55525

7.5 Élevée

Publiée le 25/08/2026 à 16:16 · Modifiée le 09/09/2026 à 23:07 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

Traduire en français

Produits concernés

MervinPraison PraisonAI
MervinPraison praisonaiagents

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r34-2g38-6569
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r34-2g38-6569

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories