CWE-918: Server-Side Request Forgery vulnerabilities

PraisonAI versions prior to 1.6.58 contain a time-of-check to time-of-use (TOCTOU) race condition in the web_crawl tool's SSRF protection. The tool validates the initial URL's hostname against private, loopback, and link-local addresses only once, but then follows redirects and re-resolves hostnames without revalidating. This allows attackers to bypass SSRF protections via HTTP redirects or DNS rebinding, potentially causing the host to fetch internal or cloud metadata endpoints and expose sensitive data. The issue is fixed in version 1.6.58.

PraisonAI versions 1.5.128 through 1.6.57 contain a server-side request forgery (SSRF) vulnerability in the web_crawl() function. The vulnerability arises because the function validates only the initially supplied URL but does not revalidate intermediate or final redirect targets when following redirects. This allows an attacker to supply a URL that passes initial checks but redirects to internal or sensitive endpoints, potentially exposing internal network resources. The issue has been fixed in version 1.6.58.

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses).

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources.

CVE-2026-9203 is a server-side request forgery (SSRF) vulnerability in Progress Software Corporation's MarkLogic Server. It affects versions 11.0.0 and 12.0.0. The flaw allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Exploiting this vulnerability can lead to disclosure of cloud credentials and compromise of cloud resources accessible to the affected host. The vulnerability has a high severity with a CVSS score of 8.5. No official patch or remediation guidance has been provided yet.

Ghost, a Node.js content management system, contained a server-side request forgery (SSRF) vulnerability in versions from 6.26.0 up to but not including 6.54.1. This flaw allowed unauthenticated users to abuse certain features, such as Webmentions, to make limited HTTP requests to internal network hosts of the Ghost server. Although the attack did not return response data, it could potentially be used to probe internal network resources. The vulnerability is fixed in version 6.54.1.

go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks).

Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does.

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).

A Server-Side Request Forgery (SSRF) vulnerability exists in TryGhost Ghost versions from 0.10.0 up to but not including 6.54.1. This flaw allows any staff-level user to perform blind HTTP GET requests to internal hosts via the Ghost Admin image fetching functionality. Although no response data is returned, the vulnerability could be used to probe internal network ports. The issue is resolved in version 6.54.1.

CVE-2026-66901 is a server-side request forgery (SSRF) vulnerability in Google::Auth for Perl versions before 0.09. The vulnerability arises because the library does not validate URLs read from the credentials JSON, allowing attackers to cause the application to make unauthorized requests to internal or external hosts. This can lead to credential exfiltration. The issue was progressively mitigated in versions 0.06 through 0.09 by adding URL validation and host checks.

NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via DNS rebinding. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by supplying a crafted local path in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure.

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.