CrewAI crewai-tools: Server-side request forgery in SeleniumScrapingTool
Summary
SeleniumScrapingTool in crewai-tools through 1.15.28 does not apply the validate_url private-address check to the URL it loads. An attacker who can influence the tool input, for example through prompt injection in web content an agent reads, can make the local headless Chrome browser fetch loopback, private network or cloud metadata addresses. This can disclose internal data and cloud credentials. CVSS v4.0 rates it 8.3 (High); the CNA record shows no exploitation and the SSVC assessment marks it as not automatable.
Affected
- crewai-tools versions 0 through 1.15.28 (crewAIInc/crewAI)
- Component: SeleniumScrapingTool
Fixed in
- Unknown. The fix is GitHub PR #6870 ("block private URLs in SeleniumScrapingTool"), which routes URLs through validate_url.
- The first release that includes this fix could not be confirmed. Check the crewAI release notes and the PR before relying on a version number.
Workaround
- Remove SeleniumScrapingTool from agents that process untrusted input, until the fix is confirmed.
- Restrict outbound traffic from agent hosts, especially to 127.0.0.0/8, RFC1918 ranges and 169.254.169.254.
- Enforce IMDSv2 or equivalent on cloud VMs that run agents.
- Run agents with least-privilege cloud identities.
Exploitation
- Not known to be exploited in the wild. The CISA KEV catalogue was not checked.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- Exploitation is indirect and requires influencing the URL the agent passes to the tool.
Our recommendation
- Inventory all systems that use crewai-tools (pip lockfiles, container images).
- Remove or disable SeleniumScrapingTool where it is not essential.
- Upgrade to a crewai-tools release confirmed to include PR #6870, and verify the fix in the installed code.
- Review cloud identities and metadata access for hosts running agents.
- Monitor agent outbound connections to internal and metadata addresses.
- Systems without crewai-tools need no action.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub PR #6870: block private URLs in SeleniumScrapingTool github.com
- Vulnerable file at version 1.15.28 github.com
- VulnCheck advisory: crewai-tools SSRF via SeleniumScrapingTool www.vulncheck.com
- OpenCVE: CVE-2026-112308 app.opencve.io
- VulDB: vuln 422413 vuldb.com
- OSV: CVE-2026-112308 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:34.
Original description (NVD)
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.