CVE-2026-57126

8.5 Élevée

Publiée le 14/09/2026 à 17:17 · Modifiée le 15/09/2026 à 16:45 · Analyse NVD reportée · Source : security-advisories@github.com

Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.

Traduire en français

Produits concernés

MervinPraison PraisonAI

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vxgj-xg5c-p4h7
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vxgj-xg5c-p4h7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories