PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

A Server-Side Request Forgery (SSRF) vulnerability exists in PraisonAI's multi-agent system prior to version praisonaiagents 1.6.58. The web_crawl function validates only the initial URL but uses httpx.Client with follow_redirects=True, meaning redirect targets are never revalidated. An attacker who can influence a crawl target can craft a redirect from a public URL to internal loopback addresses, private network ranges, or cloud metadata services (e.g., AWS IMDSv1). This bypass works even when ALLOW_LOCAL_CRAWL is disabled, as the security check only applies to the initial URL. The internal response content is returned directly to the agent context, potentially exposing sensitive infrastructure data. The vulnerability is fixed in praisonaiagents version 1.6.58.