crewai-tools CVE-2026-112308

Requires the target application to actually enable and use crewai-tools' SeleniumScrapingTool (which drives a local headless Chrome WebDriver) on a vulnerable version (through 1.15.28), and the attacker must be able to influence the agent's website_url tool input - in practice via indirect prompt injection in content the agent processes. The root cause is that the tool never calls the validate_url private-address check, so loopback, RFC1918, and link-local cloud-metadata (169.254.169.254) targets are not blocked. Limiting factors: exploitation is not a direct attacker HTTP request but depends on a successful prompt-injection path into the agent (UI:P), on the vulnerable tool being deployed, and - for cloud credential theft specifically - on the workload running in a cloud environment exposing an unauthenticated instance metadata service.

This is a credible medium-to-high priority issue, but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 8.3) signals a network-reachable, low-complexity flaw requiring no privileges but some passive user/agent interaction - consistent with an SSRF triggered indirectly via prompt injection rather than a directly attacker-controlled request. A vendor patch exists (crewAI PR #6870) and the finding was reported by VulnCheck, which lends credibility. Key signals are MISSING: no EPSS score was provided, there is no CISA KEV listing, and no public POC was supplied in the input, so exploitation status is 'no public exploit identified at time of analysis.' The main caveat is the attack-path dependency: real risk hinges on (a) the application actually using SeleniumScrapingTool and (b) an attacker's ability to influence agent tool input through (indirect) prompt injection - the CVSS PR:N does not capture that the attacker must first compromise the agent's input channel. Impact if conditions are met is serious (cloud credential and internal-data disclosure), so it warrants prompt patching for any CrewAI deployment that enables this tool, but it is not a broad, internet-wide mass-exploitation risk.

An attacker plants malicious instructions in content a CrewAI agent ingests (e.g. a web page or document), causing the agent to pass an attacker-chosen URL to SeleniumScrapingTool. Because the tool never runs the validate_url private-address check, headless Chrome navigates to http://169.254.169.254/latest/meta-data/ or an RFC1918 host and returns the content, disclosing internal data and cloud credentials. No public exploit code was identified in the provided data, but the vendor PR and VulnCheck advisory document the flaw and fix precisely.