CVE-2026-55535

6.8 Moyenne

Publiée le 25/08/2026 à 17:16 · Modifiée le 09/09/2026 à 23:07 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.

Traduire en français

Produits concernés

MervinPraison PraisonAI

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.8 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-367
CWE-918

Références

https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hmfx-4v44-9qw9

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories