https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:34:42 +0000 https://cve.radiocsirt.org/vuln/cve-2026-55535 <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.</p> <p><strong>Affected:</strong> MervinPraison PraisonAI</p> <p>PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.</p> https://cve.radiocsirt.org/vuln/cve-2026-55535 https://cve.radiocsirt.org/vuln/ghsa-hmfx-4v44-9qw9 <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>### Summary The `webhook_url` field in the Jobs API silently passes validation when DNS resolution fails (`socket.gaierror`), enabling DNS rebinding attacks. An attacker&#39;s domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.</p> <p>### Details The validator catches `socket.gaierror` and silently allows the URL:</p> <p>```python # src/praisonai/praisonai/jobs/models.py:55 try: ip = socket.gethostbyname(hostname) ip_obj = ipaddress.ip_address(ip) if ip_obj.is_private or ip_obj.is_loopback: raise ValueError(&#34;private address&#34;) except socket.gaierror: pass # BUG: DNS failure silently ignored → SSRF bypass ```</p> <p>The HTTP call is made later with no re-validation:</p> <p>```python # src/praisonai/praisonai/jobs/executor.py:402 async with httpx.AsyncClient() as client: await client.post(job.webhook_url, ...) # no second IP check ```</p> <p>### Proof of Concept</p> <p>**DNS rebinding flow:** 1. Register `attacker.com` with TTL=1s → resolves to `1.2.3.4` (public IP) 2. Submit job: `webhook_url=http://attacker.com/callback` 3. Validation passes (public IP) 4. Switch DNS: `attacker.com` → `127.0.0.1` 5. Job completes → server POSTs to `127.0.0.1` → internal SSRF</p> <p>**Unresolvable domain bypass (no DNS rebinding required):**</p> <p>```bash curl -X POST http://:8005/api/v1/runs \ -d &#39;{&#34;prompt&#34;:&#34;run&#34;,&#34;webhook_url&#34;:&#34;http://unresolvable.internal/cb&#34;,&#34;agent_yaml&#34;:&#34;...&#34;}&#39; # Validation: gaierror → pass → URL accepted ``…</p> <p><strong>Affected:</strong> PyPI: PraisonAI</p> <p>### Summary The `webhook_url` field in the Jobs API silently passes validation when DNS resolution fails (`socket.gaierror`), enabling DNS rebinding attacks. An attacker&#39;s domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.</p> <p>### Details The validator catches `socket.gaierror` and silently allows the URL:</p> <p>```python # src/praisonai/praisonai/jobs/models.py:55 try: ip = socket.gethostbyname(hostname) ip_obj = ipaddress.ip_address(ip) if ip_obj.is_private or ip_obj.is_loopback: raise ValueError(&#34;private address&#34;) except socket.gaierror: pass # BUG: DNS failure silently ignored → SSRF bypass ```</p> <p>The HTTP call is made later with no re-validation:</p> <p>```python # src/praisonai/praisonai/jobs/executor.py:402 async with httpx.AsyncClient() as client: await client.post(job.webhook_url, ...) # no second IP check ```</p> <p>### Proof of Concept</p> <p>**DNS rebinding flow:** 1. Register `attacker.com` with TTL=1s → resolves to `1.2.3.4` (public IP) 2. Submit job: `webhook_url=http://attacker.com/callback` 3. Validation passes (public IP) 4. Switch DNS: `attacker.com` → `127.0.0.1` 5. Job completes → server POSTs to `127.0.0.1` → internal SSRF</p> <p>**Unresolvable domain bypass (no DNS rebinding required):**</p> <p>```bash curl -X POST http://:8005/api/v1/runs \ -d &#39;{&#34;prompt&#34;:&#34;run&#34;,&#34;webhook_url&#34;:&#34;http://unresolvable.internal/cb&#34;,&#34;agent_yaml&#34;:&#34;...&#34;}&#39; # Validation: gaierror → pass → URL accepted ``…</p> https://cve.radiocsirt.org/vuln/ghsa-hmfx-4v44-9qw9