Crawlee for Python: SSRF via sitemap-derived URLs

Overview- Vulnerability type: Blind SSRF- Affected components: src/crawlee/utils/sitemap.py, src/crawlee/utils/robots.py, src/crawlee/requestloaders/sitemaprequestloader.py, and all built-in HTTP clients.- Trigger: an attacker-controlled sitemap or robots.txt containing a URL that points to an...

EUVD-2026-36067

Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0...

CVE-2026-46497

CVE-2026-46497 affects Crawlee (Python) from 1.0.0 up to before 1.7.0. An attacker-controlled sitemap or robots.txt can cause SSRF to internal HTTP endpoints (Layer 1) via sitemap-derived URLs, potentially affecting internal services. A second Layer (Layer 2) exists for CurlImpersonateHttpClient ...

crawlee 代码问题漏洞

Crawlee is an open-source web scraping and browser automation library developed by Apify. Versions of Crawlee from 1.0.0 to 1.7.0 had code vulnerabilities. These vulnerabilities stemmed from URLs generated using site maps, which could lead to server-side request forgeing attacks...