CVE-2026-61429: PraisonAI Crawl4AI/Chromium Backend Is Also Affected Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6g59-gm2v-qhvq",
  "modified" : "2026-10-07T20:22:17Z",
  "published" : "2026-10-07T20:22:17Z",
  "aliases" : [ "CVE-2026-61429" ],
  "summary" : "PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass",
  "details" : "## Summary\n\nThe DNS-rebinding / redirect SSRF bypass in PRAI-05 is **not limited to the httpx/urllib backend**. When `crawl4ai` (headless Chromium via Playwright) is installed, `web_crawl` auto-selects `provider=crawl4ai`, and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect (`provider: \"crawl4ai\"`). Status: runtime-confirmed addendum to PRAI-05.\n\n## Details\n\n### Affected component\n- Package `praisonaiagents` 4.6.63. Backend selected when `crawl4ai`+Playwright are installed.\n- Files: `src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py` (`_crawl_with_crawl4ai`) and `src/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py` (standalone crawl wrappers).\n\n### Vulnerable code / root cause\n\nPath:\n`src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py`\n\nFunction:\n`_crawl_with_crawl4ai`\n\nSnippet:\n```python\nasync with AsyncWebCrawler() as crawler:\n    for url in urls:\n        result = await crawler.arun(url=url)   # headless browser: re-resolves DNS, follows redirects\n```\n\nPath:\n`src/praisonai-agents/praisonaiagents/tools/crawl4ai_tools.py`\n\nFunction:\n`Crawl4AITools.crawl` / `crawl4ai`\n\nSnippet:\n```python\nresult = await crawler.arun(url=url, config=config)   # no _is_safe_crawl_url / no per-connect validation\n```\n\nIssue: the only SSRF check is the single pre-fetch `_is_safe_crawl_url()` on the initial URL string in `web_crawl()` (see PRAI-05). The headless browser then resolves and connects independently and follows redirects in-browser — no resolved-IP pinning, no per-hop/per-connect validation. Input (`urls`) is attacker/agent-controlled; the sink is `crawler.arun(url=...)`; the guard is bypassed by DNS rebinding (TOCTOU) and by redirects (followed in-browser).\n\n### Attack flow / Why bypassed / Security boundary\nIdentical to PRAI-05: TOCTOU between the guard's resolution and the browser's connection; redirects followed in-browser; internal response returned as crawl `content`. See PRAI-05.\n\n## Proof of Concept\n\n### Environment\n`crawl4ai` + Playwright Chromium installed in a dedicated runtime container (`127.0.0.1:18081`), same controlled internal canary + rebinding DNS. Runnable assets: `PraisonAI-Runtime-Repro\\runtime-files\\` (`docker-compose.crawl.yml`).\n\n### Steps to reproduce\n1. `SSRF-04-01-Crawl4AI-DNS-Rebind-Trigger` → `127.0.0.1:18081`:\n```http\nPOST /tool/web_crawl HTTP/1.1\nHost: 127.0.0.1:18081\nContent-Type: application/json\n\n{\"url\":\"http://rebind.lab:8081/secret\"}\n```\n2. Redirect variant `SSRF-04-03-Crawl4AI-Redirect-Readback`: `{\"url\":\"http://redirector:8082/redirect-to-internal\"}`.\n\n### Expected result\nThe crawl backend refuses internal destinations regardless of DNS timing/redirects.\n\n### Actual result\nHTTP 200, `\"provider\":\"crawl4ai\"`, response `content` contains `PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91` + `FAKE_INTERNAL_TOKEN_DO_NOT_USE_7f3a91` for both the DNS-rebinding and the redirect payload.\n\n### Screenshots\n\n**Crawl4AI DNS rebinding read-back**\n\nThe attacker-controlled `rebind.lab` URL is accepted by the Crawl4AI-backed `web_crawl` endpoint. PraisonAI returns the internal canary response body containing `PRAISONAI_INTERNAL_SECRET_CANARY_7f3a91`.\n\n<img width=\"1542\" height=\"763\" alt=\"01-Crawl4AI-Burp-Readback\" src=\"https://github.com/user-attachments/assets/a03b3a1c-e382-4f67-8ea6-b766dceb4a69\" />\n\n**Crawl4AI DNS rebinding runtime evidence**\n\nThe runtime log shows the Crawl4AI/Chromium backend resolving `rebind.lab` to an internal Docker IP during the fetch phase. The internal canary receives `GET /secret` from a headless Chrome user agent.\n\n<img width=\"1659\" height=\"946\" alt=\"02-Crawl4AI-DNS-Log-And-Internal-Hit\" src=\"https://github.com/user-attachments/assets/d93db090-3e39-43d0-af3b-5d1d8f614db8\" />\n\n**Crawl4AI redirect read-back**\n\nThe attacker-controlled redirector URL is accepted by the Crawl4AI-backed endpoint. PraisonAI follows the redirect and returns the internal canary response body.\n\n<img width=\"1544\" height=\"771\" alt=\"03-Crawl4AI-Redirect-Readback\" src=\"https://github.com/user-attachments/assets/7d05c8aa-5bda-45bc-b94c-bef0bdcf055c\" />\n\n**Crawl4AI redirect runtime evidence**\n\nThe controlled redirector returns `302 -> http://internal-canary:8081/secret`, and the internal canary receives `GET /secret` from the Crawl4AI/Chromium backend.\n\n<img width=\"1590\" height=\"920\" alt=\"04-Crawl4AI-Redirect-Internal-Hit-Log\" src=\"https://github.com/user-attachments/assets/dd9c0fec-3583-43ab-b83c-4470fa6aa409\" />\n\n\n## Impact\nSame class as PRAI-05: read-back SSRF to internal/metadata services, now on the crawl4ai backend. Broadens the affected surface (the flaw is in the shared validate-without-pinning design, not one backend).\n\n## Suggested remediation\nResolve-once + IP-pin + per-connect validation must also cover the crawl4ai backend (constrain the headless browser to the validated IP, or allowlist crawl destinations).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "praisonaiagents"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.6.78"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.6.77"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-61429"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/praisonai-before-ssrf-via-crawl4ai-chromium-backend"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-367", "CWE-918" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-07T20:22:17Z",
    "nvd_published_at" : null
  }
}