Host Resolution Vulnerability in PraisonAI by Mervin Praison
CVE-2026-55526
8.5HIGH
What is CVE-2026-55526?
The PraisonAI system, prior to version 1.6.58, exhibits a vulnerability in the 'spider_tools._host_is_blocked()' function, which fails to resolve ordinary hostnames before executing the 'scrape_page' function. This security flaw allows a malicious hostname like 127.0.0.1.nip.io to bypass validation, leading to potential unauthorized internal HTTP access. A fix has been implemented in version 1.6.58, utilizing 'socket.getaddrinfo' and applying a fail-closed approach on DNS errors to mitigate this risk.
Affected Version(s)
PraisonAI < 4.6.58
praisonaiagents < 1.6.58