Skip to content
Verified TaskingAI web_reader plugin SSRF via /v1/execute
REPRO-2026-00197 taskingai · github SSRF Jul 2, 2026 .txt
Severity HIGH
Confidence HIGH
Reproduced in 17m 35s
Tool calls 62
Spend $0.43
Affected commit f0092d6b2dd82e98e188e0b9849fdd4c7230dd98
$ pruva-verify REPRO-2026-00197
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00197/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

Argus scanned a fresh real GitHub target with Arbor enabled. Arbor flagged the public plugin execution boundary for missing input validation at plugin/app/routes/execute.py:117, and Metis flagged a high-confidence SSRF in the web_reader/read_web_page plugin. Manual source review found that TaskingAI Plugin exposes a documented Docker-run /v1/execute API, accepts user-supplied bundle_id, plugin_id, and input_params, validates read_web_page.url only as a required string, and then performs an outbound aiohttp request to that URL from the plugin server.

03 · Root cause
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...

05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.