Findings

CVE-2026-61429

PraisonAI: Crawl4AI/Chromium backend is also affected by the SSRF validation bypass

Published Oct 7, 2026 · updated Oct 15, 2026

## Summary The DNS-rebinding / redirect SSRF bypass in PRAI-05 is **not limited to the httpx/urllib backend**. When (headless Chromium via Playwright) is installed, auto-selects , and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect ( ). Status: runtime-confirmed addendum to PRAI-05. ## Details ### Affected component - Package 4.6.63. Backend selected when +Playwright are installed. - Files: ( ) and (standalone crawl wrappers). ### Vulnerable code / root cause Path: Function: Snippet: Path: Function: / Snippet: Issue: the only SSRF check is the single pre-fetch on the initial URL string in (see PRAI-05). The headless browser then resolves and connects independently and follows redirects in-browser — no resolved-IP pinning, no per-hop/per-connect validation. Input ( ) is attacker/agent-controlled; the sink is ; the guard is bypassed by DNS rebinding (TOCTOU) and by redirects (followed in-browser). ### Attack flow / Why bypassed / Security boundary Identical to PRAI-05: TOCTOU between the guard's resolution and the browser's connection; redirects followed in-browser; internal response returned as crawl . See PRAI-05. ## Proof of Concept ### Environment + Playwright Chromium installed in a dedicated runtime container ( ), same controlled internal canary + rebinding DNS. Runnable assets: ( ). ### Steps to reproduce 1. → : 2. Redirect variant : . ### Expected result The crawl backend refuses internal destinations regardless of DNS timing/redirects. ### Actual result HTTP 200, , response contains + for both the DNS-rebinding and the redirect payload. ### Screenshots **Crawl4AI DNS rebinding read-back** The attacker-controlled URL is accepted by the Crawl4AI-backed endpoint. PraisonAI returns the internal canary response body containing . **Crawl4AI DNS rebinding runtime evidence** The runtime log shows the Crawl4AI/Chromium backe