GHSA-vg6p-v9vm-6fgj: praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

The web_crawl tool in praisonaiagents has a security flaw where it validates a URL's hostname only once at the start, but then fetches the URL using a library that follows HTTP redirects and re-resolves the hostname without re-checking. An attacker can bypass this by either redirecting to an internal address (like a cloud metadata endpoint) or using DNS rebinding (changing what the hostname resolves to between validation and fetch) to trick the tool into reading private internal services and leaking sensitive data like credentials.