PraisonAI's web_crawl tool validates the hostname of a URL once using socket.gethostbyname to block private, loopback, or link-local addresses. However, the URL is later fetched using httpx.Client or urllib.request.urlopen, both of which follow redirects and re-resolve the hostname without further validation. This time-of-check to time-of-use (TOCTOU) race condition allows attackers who can influence URLs passed to web_crawl() to bypass SSRF protections and access internal network resources or cloud metadata endpoints. The issue is addressed in PraisonAI version 1.6.58.

An attacker able to supply or influence URLs to the web_crawl tool can cause the PraisonAI host to make unauthorized requests to internal network addresses, loopback interfaces, or cloud metadata services. This can lead to disclosure of sensitive internal information (confidentiality impact) and partial integrity impact due to unauthorized data retrieval. There is no impact on availability. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, high complexity, no privileges or user interaction required, and scope change.

A fix is available in PraisonAI version 1.6.58. Users should upgrade to this version or later to remediate the vulnerability. Until upgraded, avoid passing untrusted URLs to the web_crawl tool or ensure additional validation on URLs before use. Patch status is not explicitly stated beyond the fixed version; check vendor advisories for further guidance.