Crewai Tools
Monthly
Server-side request forgery in the SeleniumScrapingTool of crewai-tools through 1.15.28 lets an attacker who can influence the agent's website_url input - in practice through indirect prompt injection in content the agent processes - steer the local headless Chrome WebDriver to loopback, RFC1918, and link-local cloud-metadata addresses such as 169.254.169.254, disclosing internal service responses and potentially cloud instance credentials. The flaw is unauthenticated from the tool's perspective (CVSS v4.0 AV:N/PR:N, assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), requires the victim deployment to actually have the tool enabled, and is limited to information disclosure - no integrity or availability impact is assessed. An upstream fix has been proposed in crewAI pull request #6870, but no public exploit code was identified at time of analysis and the issue is not in CISA KEV; it is a credible medium-to-high priority issue rather than an emergency.
Server-side request forgery in the SeleniumScrapingTool of crewai-tools through 1.15.28 lets an attacker who can influence the agent's website_url input - in practice through indirect prompt injection in content the agent processes - steer the local headless Chrome WebDriver to loopback, RFC1918, and link-local cloud-metadata addresses such as 169.254.169.254, disclosing internal service responses and potentially cloud instance credentials. The flaw is unauthenticated from the tool's perspective (CVSS v4.0 AV:N/PR:N, assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), requires the victim deployment to actually have the tool enabled, and is limited to information disclosure - no integrity or availability impact is assessed. An upstream fix has been proposed in crewAI pull request #6870, but no public exploit code was identified at time of analysis and the issue is not in CISA KEV; it is a credible medium-to-high priority issue rather than an emergency.