The flaw lies in spider_tools._host_is_blocked() which skips DNS resolution of ordinary hostnames before performing a scrape. A hostname such as 127.0.0.1.nip.io is accepted and resolves to the loopback address, allowing the agent to reach internal services that would normally be blocked. As a result, an attacker can trigger a server‑side request that goes to local or internal endpoints, potentially exposing sensitive data or enabling further compromise. This is a classic SSRF issue flagged by CWE‑918, with an associated credential or sensitive information exposure concern (CWE‑350).

All installations of MervinPraison PraisonAI and the praisonaiagents component that use a version earlier than 1.6.58 are affected. The vulnerability was fixed in the 1.6.58 release.

The vulnerability has a CVSS score of 8.5, classifying it as high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to cause the agent to perform a scrape on a crafted hostname that resolves to an internal address. The attack vector is likely a remote, network‑based request to the agent, with no explicit authentication requirement noted. Successful exploitation can lead to internal network discovery or unauthorized data access.