The flaw arises because the web_crawl function only validates the initial URL and then follows redirects without re‑checking them. An attacker who controls the initial crawl target can craft a redirect to a private network address, localhost or a cloud metadata service, while the system still blocks direct local crawling. The result is that internal addresses are reached, and the response is returned to the agent’s context, allowing data exfiltration or internal discovery. This is a classic server‑side request forgery, mapped to CWE‑918.

The issue impacts the praisonaiagents component of the PraisonAI multi‑agent system. All releases of praisonaiagents before version 1.6.58 are affected. The fix was released in the 1.6.58 update, which is part of the PraisonAI 4.6.58 release series.

With a CVSS score of 7.5 the vulnerability is considered high severity. No EPSS score is available and the flaw is not listed in CISA KEV, indicating limited known exploitation, yet the attack path remains viable. An attacker who can supply a URL to the vulnerable web_crawl function can trigger outbound requests to unintended internal resources without needing elevated host privileges. The exploitation relies merely on the redirect logic, making the risk substantial for deployments still running unpatched versions.