CVE-2026-61429
PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
CVSS Score
8.5
EPSS Score
0.2%
EPSS Percentile
13th
PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
| CWE | CWE-918 |
| Vendor | mervinpraison |
| Product | praisonai |
| Published | Jul 11, 2026 |
| Last Updated | Jul 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for mervinpraison praisonai
Be the first to know when new high vulnerabilities affecting mervinpraison praisonai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
MervinPraison / PraisonAI
0 < 1.6.78
References
Credits
🔍 dinhvaren