Security Vulnerability in PraisonAI Affected by Poor URL Validation

CVE-2026-55525

What is CVE-2026-55525?

The PraisonAI system, a multi-agent framework, is susceptible to a security flaw in its web crawling functionality. Specifically, prior to version 1.6.58, the system's web_crawl function only validates the initial URL input and fails to revalidate redirect targets during subsequent HTTP requests. This oversight allows an attacker to manipulate crawl targets and redirect users to potentially harmful destinations, such as loopback addresses, private networks, or cloud metadata services. This issue could be exploited even with the ALLOW_LOCAL_CRAWL setting disabled, resulting in internal network data being fetched and returned inappropriately within the agent's context. The vulnerability has been addressed in the release of version 1.6.58.

References