# crewai-tools: a scraping tool skips the SSRF check on agent URLs

> SeleniumScrapingTool hands an agent-supplied URL to headless Chrome without the private-address check its sibling tools apply.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-19
- **CVE:** CVE-2026-112308
- **CVSS:** 8.3
- **Affects:** crewAI, crewai-tools (PyPI)
- **Research by:** SashaMIT, Zachariah Mithani
- **Primary source:** https://www.vulncheck.com/advisories/crewai-tools-through-1.15.28-ssrf-via-seleniumscrapingtool
- **Page:** https://theinjection.dev/items/crewai-tools-selenium-scraping-ssrf/

CVE-2026-112308 is a server-side request forgery flaw in the SeleniumScrapingTool of crewai-tools, which skips the private-address check the package applies in its other scraping tools. VulnCheck lists no fixed version.

## What happened

VulnCheck published CVE-2026-112308 on October 19, 2026, crediting SashaMIT and Zachariah Mithani. The advisory covers crewai-tools through version 1.15.28, the tool library for the crewAI agent framework. GitHub's advisory database carries the same report as GHSA-5595-9g9c-5cc4.

## How it works

SeleniumScrapingTool never calls validate_url, the helper that the Firecrawl and Scrapfly tools in the same package use to block private addresses. An attacker who gets instructions into the agent's tool input can therefore set website_url to a loopback, RFC1918 or cloud metadata address, and the headless Chrome browser fetches it. VulnCheck says the result can expose internal data and cloud credentials.

## Who is affected

Crews that register SeleniumScrapingTool are the exposed configuration, and VulnCheck lists crewai-tools releases up to and including 1.15.28. The tool's source on the project's main branch checks only that the URL starts with http or https and contains no whitespace, with no host resolution.

## What to do

Remove SeleniumScrapingTool from crews that scrape pages an attacker can influence, or put it behind a tool that resolves the host and rejects loopback, link-local and private ranges. Block the agent host's access to cloud metadata endpoints at the network layer.

## Quick facts

- **Affected:** crewai-tools through 1.15.28, SeleniumScrapingTool
- **CVE:** CVE-2026-112308
- **CVSS:** 8.3, CVSS v4.0, per VulnCheck and GitHub
- **Attack type:** Prompt injection into tool input, then SSRF
- **Found by:** SashaMIT and Zachariah Mithani
- **Disclosed:** 19 October 2026
- **Status:** No fixed version listed, fix pull request closed unmerged

## Questions

### Is crewai-tools patched against CVE-2026-112308?

VulnCheck lists no fixed version for CVE-2026-112308. The pull request that adds the private-address check to SeleniumScrapingTool, crewAI 6870, was opened on August 8, 2026 and closed on September 17, 2026 without being merged, after a bot flagged that first-time contributor pull requests must reference an open issue. The tool's current source on main still carries only a scheme check.

### Which crewAI deployments are exposed to this SSRF?

Crews that register SeleniumScrapingTool from crewai-tools are exposed, and VulnCheck's advisory lists releases up to and including 1.15.28. Crews built only from the package's other scraping tools, such as the Firecrawl and Scrapfly tools, call validate_url instead. Checking which tools a crew registers is the fastest way to tell whether the flaw applies.

### What can an attacker read through this crewai-tools flaw?

VulnCheck says a successful request can expose internal data and cloud credentials, because headless Chrome will fetch loopback, RFC1918 and cloud metadata addresses. The advisory scores the flaw 8.3 on CVSS v4.0, with high confidentiality impact on both the vulnerable system and subsequent systems, and no integrity or availability impact.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/crewai-tools-through-1.15.28-ssrf-via-seleniumscrapingtool)
2. [GitHub Advisory](https://github.com/advisories/GHSA-5595-9g9c-5cc4)
3. [Closed Fix PR](https://github.com/crewAIInc/crewAI/pull/6870)
4. [Tool Source](https://github.com/crewAIInc/crewAI-tools/blob/main/crewai_tools/tools/selenium_scraping_tool/selenium_scraping_tool.py)