HighVulnerability

GHSA-x44h-65qv-cw74: praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-55526GHSA-x44h-65qv-cw74
Published: August 25, 2026
Record updated: October 9, 2026

Affected: praisonaiagents < 1.6.58
Fixed in: 1.6.58
released June 13, 2026, 73 days before disclosure
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.4%

Summary

praisonaiagents, in tools/spider_tools.py, has an SSRF protection bypass in _host_is_blocked(). The function checks only literal IP strings and hostname aliases and never performs DNS resolution, so any hostname resolving to a private or loopback address, such as 127.0.0.1.nip.io, passes the filter. A live exploit shows scrape_page("http://127.0.0.1.nip.io:PORT/secret") returns the response of an internal service, and scrape_page, extract_links, crawl and extract_text are registered as LLM-callable tools.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.4%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.
Disclosure date: August 25, 2026

Affected

Packages: praisonaiagents@< 1.6.58 (fixed: 1.6.58)

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: Agent
Impact: Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-x44h-65qv-cw74

First tracked: August 25, 2026 at 02:01 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Summary

Mitigation

Related items