CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.58 are vulnerable due to improper handling of DNS resolution in the JobSubmitRequest.validate_webhook_url() method, which can allow attackers to manipulate webhook URLs and redirect requests to internal services. This vulnerability poses a high risk as it could lead to unauthorized access or data exfiltration. Organizations using affected versions should prioritize updating to version 4.6.58 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() later performs a fresh lookup, allowing DNS changes to direct the request to an internal service. This issue is fixed in version 4.6.58.