CyberRota Analysis
AI-GeneratedPrior to version 1.6.59, PraisonAI's SpiderTools.scrape_page function fails to properly validate URLs before following redirects, potentially allowing attackers to exploit this vulnerability to access sensitive information from private or restricted services. The impact includes unauthorized disclosure of data through redirected requests that could lead to exposure of internal resources. Organizations using affected versions of PraisonAI should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.