Detections
Analytics

SCA: security update for praisonaiagents (GHSA-vg6p-v9vm-6fgj)

high Tenable Self-Hosted Container Security Plugin ID 446275

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF
 check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to
 attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and
 rejects private/loopback/link-local results, but then passes the URL to a fetcher using
 httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows
 redirects) that re-resolves the hostname at connect time with no further validation. This validate-
 here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can
 influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the
 PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host,
 with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58.
 (CVE-2026-55524)

Solution

Update the praisonaiagents library and its related packages to version 1.6.58 or later.

See Also

https://github.com/advisories/GHSA-vg6p-v9vm-6fgj

Plugin Details

Severity: High

ID: 446275

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/25/2026

Updated: 8/25/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.7

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:N

CVSS Score Source: CVE-2026-55524

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/25/2026

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-55524