CVE-2026-120630

Full vulnerability record from the local CVENow database.

Description

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-11-02 18:18:52.870000

Last modified

2026-11-02 18:18:52.990000

View original CVE JSON

{
  "id": "CVE-2026-120630",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-02T18:18:52.870",
  "lastModified": "2026-11-02T18:18:52.990",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "CrewAI",
          "product": "CrewAI",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.15.17",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/crewAIInc/crewAI/pull/6981",
      "source": "[email protected]"
    },
    {
      "url": "https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents/",
      "source": "[email protected]"
    }
  ]
}