PraisonAI’s web_crawl utility validates the supplied URL’s hostname only once, just before the request is made. The validation blocks private, loopback, and link‑local addresses, but after the check the URL is handed to an HTTP client that follows redirects and re‑resolves the hostname at connect time without any further filtering, creating a validate‑here/fetch‑there gap—an instance of CWE‑367. The flaw allows an attacker to supply a URL that redirects to or DNS‑binds to an internal or cloud‑metadata endpoint, which the PraisonAI host then requests and returns in the web_crawl result, effectively disclosing internal network data. This is a classic example of CWE‑918 (Server‑Side Request Forgery).

The vulnerability affects the PraisonAI product from MervinPraison. Any release prior to version 1.6.58 is impacted; the issue resides in the web_crawl component. Upgrades to 1.6.58 or higher include the fix.

With a CVSS score of 7.5 the flaw is classified as high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, so no large‑scale exploitation is known. However, exploitation requires only an ability to influence URLs passed to web_crawl(), which may be exercised through direct API calls or via internal tool workflows. The redirect and DNS rebinding paths allow an attacker to reach loopback, private, link‑local, or cloud‑metadata services from the host, providing the attacker with sensitive internal information.