{"id":"CVE-2026-57115","title":"PraisonAI is a multi-agent teams system","summary":"PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loop…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"MervinPraison","product":"PraisonAI","affected":["PraisonAI < 4.6.59","praisonaiagents < 1.6.59"],"patched":["praisonaiagents 1.6.59"],"published":"2026-09-14","updated":"2026-09-15","sourceUpdated":"2026-09-15T14:45:28.563","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57115","references":[{"url":"https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59","label":"security-advisories@github.com"},{"url":"https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59","label":"security-advisories@github.com"},{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h9p-93hq-q7h6","label":"security-advisories@github.com"},{"url":"https://github.com/MervinPraison/PraisonAI"}],"tags":["nvd","cve.org","osv","pip"],"epss":0.00257,"epssPercentile":0.17622,"aliases":["GHSA-6h9p-93hq-q7h6"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T16:14:28.824339Z"},"ingestedAt":"2026-07-21T19:04:56.400Z","slug":"CVE-2026-57115","body":"## Overview\n\nPraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-57115)\n\nAffected packages:\n\n- `praisonaiagents < 1.6.59`\n\nPatched in:\n\n- `praisonaiagents 1.6.59`\n\nSource: https://osv.dev/vulnerability/GHSA-6h9p-93hq-q7h6","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}