Threat Intelligence Database

PraisonAI versions prior to 1.6.58 contain a time-of-check to time-of-use (TOCTOU) race condition in the web_crawl tool's SSRF protection. The tool validates the initial URL's hostname against private, loopback, and link-local addresses only once, but then follows redirects and re-resolves hostnames without revalidating. This allows attackers to bypass SSRF protections via HTTP redirects or DNS rebinding, potentially causing the host to fetch internal or cloud metadata endpoints and expose sensitive data. The issue is fixed in version 1.6.58.

PraisonAI versions 1.5.128 through 1.6.57 contain a server-side request forgery (SSRF) vulnerability in the web_crawl() function. The vulnerability arises because the function validates only the initially supplied URL but does not revalidate intermediate or final redirect targets when following redirects. This allows an attacker to supply a URL that passes initial checks but redirects to internal or sensitive endpoints, potentially exposing internal network resources. The issue has been fixed in version 1.6.58.

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow allows any @claude comment to trigger the job regardless of whether the commenter is a trusted collaborator. An outside contributor can open a pull request from a fork whose branch name contains shell metacharacters and comment @claude, causing Bash to execute arbitrary shell code in the GitHub Actions runner. Because these commands run in a job holding a GitHub App token with write permissions, OIDC access, and gh/git access, the injection can be chained through $GITHUB_PATH to compromise later privileged steps, enabling repository writes, pull request and issue manipulation, or OIDC-token abuse. This issue has been fixed in version 4.6.40.