CVE-2026-55523

## Summary `praisonaiagents.tools.web_crawl_tools.web_crawl()` validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses `httpx.Client(follow_redirects=True)` and does not revalidate redirect targets. An attacker-controlled public URL can pass the initial host check, redirect to loopback/private/cloud metadata infrastructure, and have the redirected response body returned by `web_crawl()`. This appears to be an incomplete fix / patch bypass for the published `web_crawl` SSRF class (`GHSA-qq9r-63f6-v542` / `CVE-2026-40160`, and `GHSA-8f4v-xfm9-3244`). ## Affected Component Package: ```text praisonaiagents ``` File: ```text src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py ``` Functions: ```text web_crawl() _crawl_with_httpx() ``` ## Affected Versions Validated affected: - `praisonaiagents 1.5.128` via repository tag `v4.5.128`; - `praisonaiagents 1.6.40` via repository tag `v4.6.40`; - `praisonaiagents 1.6.56` via repository tag `v4.6.56`; - current `origin/main` commit `095653d78a01cc6c80ff5b2dd20a8e5619686ddc`. Suggested affected range for maintainer confirmation: ```text >= 1.5.128, <= 1.6.56 ``` No patched version is known to me at submission time. ## Root Cause Current `web_crawl()` validates only the initially supplied URL: - requires `http` or `https`; - resolves the initial hostname with `socket.gethostbyname()`; - rejects loopback/private/link-local/multicast/unspecified addresses unless `ALLOW_LOCAL_CRAWL=true`. The default fetch sink then follows redirects: ```python with httpx.Client(follow_redirects=True, timeout=30.0) as client: response = client.get(url) ``` There is no validation of intermediate or final redirect destinations before `httpx` fetches them. The URL that passes the guard is therefore not necessarily the URL ultimately requested by the server. ## Local Reproduction The PoV is local-only. It starts a loopback redirector and a loopba