PraisonAI’s spider_tools module validates URLs before making outbound requests. The filter only blocks a small set of exact host strings such as localhost and 127.0.0.1. It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or verify the resolved IP address. As a result, an attacker who can supply URLs to the scrape_page, crawl, or extract_text functions can craft URL strings that bypass the filter, allowing the server to make requests to loopback‑only services. This constitutes a server‑side request forgery that can expose internal system capabilities. The vulnerability is identified as CWE‑918.

The flaw exists in PraisonAI versions earlier than 4.6.40 and in the corresponding praisonaiagents package prior to version 1.6.40. Any deployment running these older releases is potentially vulnerable if URL inputs can be supplied by or influence an attacker. The patch is already available in the stated release series.

The CVSS score of 5.5 reflects moderate severity, and the EPSS score of less than 1 percent indicates that, at present, the likelihood of exploitation is considered low. The vulnerability is not listed in CISA’s KEV catalog. The attack vector requires attacker supplied URLs to be processed by the vulnerable functions, which can generally be achieved through remote or potentially local input channels. While the attack is possible, the combined low exploitation probability and moderate impact suggest that patching is recommended but the urgency is less than for high‑severity SSRF flaws.