THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-x44h-65qv-cw74 (high) — praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

[GHSA] GHSA-x44h-65qv-cw74 (high) — praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

highgithub_advisoriesPublished 2026-08-25

GHSA-x44h-65qv-cw74 Severity: high CVE: CVE-2026-55526

praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

### Summary

`praisonaiagents/tools/spider_tools.py` contains an SSRF protection bypass. The function `_host_is_blocked()` validates URLs against a list of blocked IP literals and hostname aliases, but **never pe

MITRE ATT&CK techniques

Cloud AccountT1087.004
Cloud AccountT1136.003
CredentialsT1589.001

Indicators of compromise

CVE-2026-55526cve
http://127.0.0.1.nip.io:PORT/secreturl
http://127.0.0.1.nip.io/url
http://127.0.0.1.nip.io:{PORT}/secrets.jsonurl
http://127.0.0.1.nip.io:8080/adminurl
http://127.0.0.1.nip.io/`url
http://10.0.0.1.nip.io/`url
http://169-254-169-254.sslip.io/latest/meta-data/iam/security-credentials/`url

Original source: https://github.com/advisories/GHSA-x44h-65qv-cw74