CVE-2026-46497

CVE-2026-46497 affects Crawlee (Python) from 1.0.0 up to before 1.7.0. An attacker-controlled sitemap or robots.txt can cause SSRF to internal HTTP endpoints (Layer 1) via sitemap-derived URLs, potentially affecting internal services. A second Layer (Layer 2) exists for CurlImpersonateHttpClient ...

Server-side Request Forgery (SSRF)

Overview crawlee is a Crawlee for Python Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the sitemap or robots.txt processing pipeline. An attacker can coerce the crawler into making requests to internal or non-HTTP endpoints by supplying a malicious sitem...