CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:NCVE-2026-55537
High (7.1). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in praisonai 4.6.58.
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() later performs a fresh lookup, allowing DNS changes to direct the request to an internal service. This issue is fixed in version 4.6.58.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-367, CWE-705, CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rg5q-pp8p-f7jm | PyPI | praisonai | <4.6.58 | 4.6.58 |
| PYSEC-2026-3895 | PyPI | praisonai | <4.6.58 | 4.6.58 |