CVE-2026-112308
HighCVSS 7.4Summary
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
Risk Assessment
The organization may suffer leakage of internal resources and cloud credentials, potentially leading to account takeover and further escalation. The risk applies to environments where AI agents use SeleniumScrapingTool.
Recommendation
Update crewai-tools to a version later than 1.15.28 if available, or implement custom URL validation blocking private and metadata addresses. Restrict network permissions of processes running headless Chrome.
Other vulnerabilities in crewai-tools
See all- CVE-2026-37007Critical
Vulnerability in the FileWriterTool component of crewai-tools <= 1.10.2rc1. A remote attacker can achieve code execution via malicious path traversal sequences in the filename argument.
- CVE-2026-37009Medium
SQL injection vulnerability in the NL2SQLTool component of crewai-tools v1.10.2rc1. A remote attacker can execute arbitrary SQL commands via an unsanitized sql_query argument.
Original NVD description (English source)
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS