What is GHSA-3wrm-pm5v-8vq8?

GHSA-3wrm-pm5v-8vq8 is a security advisory published by GitHub Security Advisories with Medium severity. PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in...

Which CVE IDs does GHSA-3wrm-pm5v-8vq8 cover?

GHSA-3wrm-pm5v-8vq8 covers the following CVE IDs: CVE-2026-60091. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3wrm-pm5v-8vq8?

GHSA-3wrm-pm5v-8vq8 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-3wrm-pm5v-8vq8MediumCVSS 7.2

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in...

Vendor

GitHub Security Advisories

Published

July 10, 2026

Last Modified

July 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-60091 →

📋 Description

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

🔗 References (4)

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4w49-gwv8-fpjg
https://nvd.nist.gov/vuln/detail/CVE-2026-60091
https://www.vulncheck.com/advisories/praisonai-before-unauthenticated-ssrf-via-webhook-url
https://github.com/advisories/GHSA-3wrm-pm5v-8vq8