Praisonaiagents: Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

PraisonAI versions before 1.6.78 contain an SSRF vulnerability in the Crawl4AI/Chromium backend. Attackers can bypass SSRF validation by exploiting DNS rebinding and HTTP redirects, causing the headless browser to follow redirects to internal services after initial validation. This allows reading of internal responses, including sensitive canary values. The advisory is a duplicate of GHSA-6g59-gm2v-qhvq and has been withdrawn. The vulnerability is tracked under CWE-918 and has a CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

Successful exploitation allows attackers with low privileges to bypass SSRF protections and access internal services, potentially exposing sensitive information such as canary values. The vulnerability impacts confidentiality significantly (high impact), with limited integrity impact and no availability impact. This could facilitate further attacks leveraging exposed internal data.

No explicit patch or remediation link is provided in the advisory. Patch status is not yet confirmed — check the vendor advisory GHSA-6g59-gm2v-qhvq for current remediation guidance. Until a fix is applied, restrict access to internal services and monitor for suspicious SSRF activity. The advisory is withdrawn as a duplicate; refer to the primary advisory for updates.