ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-61429

PraisonAI: Crawl4AI/Chromium backend is also affected by the SSRF validation bypass

Published Oct 7, 2026 · catalog updated Oct 15, 2026 · PraisonAI: Crawl4AI/Chromium backend is

Check if you run it

No confirmed exploitation is on record for CVE-2026-61429. EPSS is 0.35%. Act only if a listed version of PraisonAI: Crawl4AI/Chromium backend is is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (PraisonAI: Crawl4AI/Chromium backend is).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.35%
Remediation
Advisory link
Affected products
PyPI praisonaiagents

## Summary The DNS-rebinding / redirect SSRF bypass in PRAI-05 is **not limited to the httpx/urllib backend**. When (headless Chromium via Playwright) is installed, auto-selects , and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect ( ). Status: runtime-confirmed addendum to PRAI-05. ## Details ### Affected component - Package 4.6.63. Backend selected when +Playwright are installed. - Files: ( ) and (standalone crawl wrappers). ### Vulnerable code / root cause Path: Function: Snippet: Path: Function: / Snippet: Issue: the only SSRF check is the single pre-fetch on the initial URL string in (see PRAI-05). The headless browser then resolves and connects independently and follows redirects in-browser — no resolved-IP pinning, no per-hop/per-connect validation. Input ( ) is attacker/agent-controlled; the sink is ; the guard is bypassed by DNS rebinding (TOCTOU) and by redirects (followed in-browser). ### Attack flow / Why bypassed / Security boundary Identical to PRAI-05: TOCTOU between the guard's resolution and the browser's connection; redirects followed in-browser; internal response returned as crawl . See PRAI-05. ## Proof of Concept ### Environment + Playwright Chromium installed in a dedicated runtime container ( ), same controlled internal canary + rebinding DNS. Runnable assets: ( ). ### Steps to reproduce 1. → : 2. Redirect variant : . ### Expected result The crawl backend refuses internal destinations regardless of DNS timing/redirects. ### Actual result HTTP 200, , response contains + for both the DNS-rebinding and the redirect payload. ### Screenshots **Crawl4AI DNS rebinding read-back** The attacker-controlled URL is accepted by the Crawl4AI-backed endpoint. PraisonAI returns the internal canary response body containing . **Crawl4AI DNS rebinding runtime evidence** The runtime log shows the Crawl4AI/Chromium backe

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI praisonaiagents0 → 1.6.78

How to fix CVE-2026-61429

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-61429. EPSS is 0.35%. Act only if a listed version of PraisonAI: Crawl4AI/Chromium backend is is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.6.78. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information; CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-918: Server-Side Request Forgery (SSRF). EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 7, 2026 · GitHub Advisory Database

    Detected

    ## Summary The DNS-rebinding / redirect SSRF bypass in PRAI-05 is **not limited to the httpx/urllib backend**. When (headless Chromium via Playwright) is installed, auto-selects , and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect ( ). Status: runtime-c

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    praisonaiagents fixed in 1.6.78

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    praisonaiagents fixed in 1.6.78

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary The DNS-rebinding / redirect SSRF bypass in PRAI-05 is **not limited to the httpx/urllib backend**. When (headless Chromium via Playwright) is installed, auto-selects , and the headless browser re-resolves DNS and follows redirects on its own — with no per-connection SSRF guard. Runtime-confirmed read-back of the internal canary via both DNS rebinding and redirect ( ). Status: runtime-c

Sources

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.