Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via SeleniumScrapingTool, which never applies the validateurl private-address check before passing attacker-controlled URLs to headless Chrome. An...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112308

The crewai-tools library (through version 1.15.28 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the SeleniumScrapingTool . The root cause is a failure to apply the validate_url private-address check, allowing attackers who can influence agent tool input via prompt injection...

CVE-2026-112308 crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

EUVD-2026-104400

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112308 crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112308 crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

PT-2026-117468

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate url private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112308: Server-Side Request Forgery (SSRF)

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

agentchaos-sdk (0.1.0), agentic-control-crews (0.2.0) +7 more potentially affected by CVE-2026-37008 via crewai-tools (1.6.1)

crewai-tools PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - agentchaos-sdk 0.1.0 - agentic-control-crews 0.2.0 - agentics-py =0.0.6, =0.1.0, =0.1.0, =0.1.5, =0.2.3 Source cves: CVE-2026-37008 Sour...

Improper Protection of Alternate Path

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to the blocklist mechanism operating at the import system level rather than accounting for the complete Python runtime. An attacker can...

adaptiq (0.12.9), agentchaos-sdk (0.1.0) +23 more potentially affected by CVE-2026-37008 via crewai-tools (>=0.45.0, <=1.6.1)

crewai-tools PYPI version =0.45.0, =0.1.0, =0.0.6, =0.1.7, =0.2.6, =0.1.0, =0.5.42, =0.1.0, =0.74.0, =0.86.0 - crewai-ldn 0.1.0 - faq-rai-sdk 0.1.4 and more Source cves: CVE-2026-37008 Source advisory: MEND:CVE-2026-37008...

hdw-tools (>=0.0.2, <=0.0.5), llm-foundation (>=0.0.19, <=0.0.23) potentially affected by CVE-2026-62240 via crewai-tools (0.13.4)

crewai-tools PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - hdw-tools =0.0.2, =0.0.19, =0.0.23 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...

lpw (0.2.5.0) potentially affected by CVE-2026-62240 via crewai-tools (0.14.0)

crewai-tools PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - lpw 0.2.5.0 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...

langflow-base (0.1.1), langflow-base-nightly (>=0.1.0.dev7, <=0.1.1.dev6) +1 more potentially affected by CVE-2026-62240 via crewai-tools (0.17.0)

crewai-tools PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - langflow-base 0.1.1 - langflow-base-nightly =0.1.0.dev7, =0.1.1.dev6 - langinfra-base 0.1.1 Source cves: CVE-2026-62240 Source advisory...

graphtomation (>=0.0.3, <=0.0.5) potentially affected by CVE-2026-62240 via crewai-tools (0.25.8)

crewai-tools PYPI version 0.25.8 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - graphtomation =0.0.3, =0.0.5 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...

faq-rai-sdk (0.1.4), maq-rai-sdk (>=0.1.2, <=0.2.0) potentially affected by CVE-2026-62240 via crewai-tools (0.45.0)

crewai-tools PYPI version 0.45.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - faq-rai-sdk 0.1.4 - maq-rai-sdk =0.1.2, =0.2.0 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...

praisonai-tools (>=0.0.16, <=0.0.21) potentially affected by CVE-2026-62240 via crewai-tools (0.49.0)

crewai-tools PYPI version 0.49.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - praisonai-tools =0.0.16, =0.0.21 Source cves: CVE-2026-62240 Source advisory: OSV:PYSEC-2026-3819...

adaptiq (0.12.9), agentic-ai-vass-tools (>=0.1.0, <=0.4.0) +13 more potentially affected by CVE-2026-62240 via crewai-tools (0.76.0)

crewai-tools PYPI version 0.76.0 is affected by a known vulnerability. The following packages have a transitive dependency on crewai-tools and may be impacted: - adaptiq 0.12.9 - agentic-ai-vass-tools =0.1.0, =0.1.7, =0.2.6, =0.1.0, =0.5.42, =0.74.0, =0.0.24, =0.1.0, =0.0.14, =0.1.0, =0.0.1,...