Skip to content
Fencer Vulns
medium 5.5

CVE-2026-47390 json

PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

published 2026-05-29 5 mo ago modified 2026-07-22 3 mo ago also EUVD-2026-46278 , GHSA-5c6w-wwfq-7qqm , PYSEC-2026-2902 , PYSEC-2026-2941

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as `localhost` and `127.0.0.1`. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. As a result, certain URLs may bypass the protection and still reach loopback services. After the weak validation passes, `scrape_page()` calls `requests.Session.get()` on the attacker-controlled URL. This allows an attacker who can influence URLs passed to `scrape_page`, `crawl`, or `extract_text` to induce SSRF requests against loopback-only services. This is a server-side request forgery protection bypass. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a patch.

Patch / fix

  • pypi praisonaiagents 1.6.40
  • pypi praisonai 4.6.40
  • praison praisonai 4.6.40
  • praison praisonaiagents 1.6.40

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5c6w-wwfq-7qqm referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi praisonaiagents
<1.6.40
1.6.40
pypi praisonai
<4.6.40
4.6.40

Affected products

  • MervinPraison PraisonAI
  • MervinPraison praisonaiagents

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.