CVE-2026-55526

The record

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58.

Affected packages

Related vulnerabilities

• CVE-2026-46611 Glances is an open-source system cross-platform monitoring tool. CWE-350
• CVE-2026-12635 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before… CWE-350
• CVE-2026-36604 Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the… CWE-350
• GHSA-fvh2-gm75-j4j7 dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport CWE-350
• CVE-2026-42559 RMCP is an official Rust SDK for the Model Context Protocol. CWE-350
• GHSA-3vr4-cvmg-7fx4 copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action CWE-350
• CVE-2026-6874 A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. CWE-350
• GHSA-xq94-r468-qwgj OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding CWE-350