GHSA-6G59-GM2V-QHVQ PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

Summary The DNS-rebinding / redirect SSRF bypass in PRAI-05 is not limited to the httpx/urllib backend. When crawl4ai headless Chromium via Playwright is installed, webcrawl auto-selects provider=crawl4ai, and the headless browser re-resolves DNS and follows redirects on its own — with no...

GHSA-RC3Q-9PXG-3JHR Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6g59-gm2v-qhvq. This link is maintained to preserve external references. Original Description PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend...

Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6g59-gm2v-qhvq. This link is maintained to preserve external references. Original Description PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend...

CVE-2026-61429: Server-Side Request Forgery (SSRF)

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial...