GHSA-rjvw-7vvw-549v

# Jobs webhook SSRF protection bypass via DNS rebinding ## Summary PraisonAI's Async Jobs API validates `webhook_url` when a job request is parsed and again when the internal `Job` object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, `_send_webhook()` passes the original hostname to `httpx.AsyncClient.post()` with no send-time validation, IP pinning, or guarded transport. An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases. This appears to be an incomplete fix / patch bypass for `GHSA-8frj-8q3m-xhgm` ("Server-Side Request Forgery via Unvalidated webhook_url in Jobs API"). I defer to maintainers on whether this should be a new advisory/CVE or an amendment to the prior advisory, but current supported releases still appear affected. ## Affected Component Package: ```text praisonai ``` Files: ```text src/praisonai/praisonai/jobs/models.py src/praisonai/praisonai/jobs/executor.py src/praisonai/praisonai/jobs/router.py ``` Relevant code paths: ```text JobSubmitRequest.validate_webhook_url() Job.validate_webhook_url() JobExecutor._send_webhook() POST /api/v1/runs ``` ## Affected Versions Validated affected: - `v4.5.126` (`f00763937bf7f4d091e84533692fc0576fca9b99`); - `v4.5.128` (`b4e3a8a8`); - `v4.6.56` (`d3c4a2af`); - `v4.6.57` (`e90d92231853161ad931f3498da57651a9f8b528`); - current `main` (`2f9677abb2ea68eab864ee8b6a828fd0141612e1`, `v4.6.57-4-g2f9677ab`). Suggested affected range for maintainer confirmation: ```text >= 4.5.126, <= 4.6.57 ``` No patched version is known to me at submission time. `v4.5.124` and earlier are covered by the older unvalidated-webhook advisory. This report is scoped to patched-era releases where direct loopback/private webhook