What is GHSA-rc3q-9pxg-3jhr?

GHSA-rc3q-9pxg-3jhr is a security advisory published by GitHub Security Advisories with High severity. PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the...

Which CVE IDs does GHSA-rc3q-9pxg-3jhr cover?

GHSA-rc3q-9pxg-3jhr covers the following CVE IDs: CVE-2026-61429. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rc3q-9pxg-3jhr?

GHSA-rc3q-9pxg-3jhr has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

GHSA-rc3q-9pxg-3jhrHighCVSS 8.5

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the...

Vendor

GitHub Security Advisories

Published

July 11, 2026

Last Modified

July 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-61429 →

📋 Description

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.

🔗 References (4)

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq
https://nvd.nist.gov/vuln/detail/CVE-2026-61429
https://www.vulncheck.com/advisories/praisonai-before-ssrf-via-crawl4ai-chromium-backend
https://github.com/advisories/GHSA-rc3q-9pxg-3jhr