CVE-2026-120630

— UNSCOREDpublic exploit available

Published 2026-11-02 · Updated 2026-11-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.

Public exploit & PoC references

https://github.com/crewAIInc/crewAI/pull/6981

All references

https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool
https://github.com/crewAIInc/crewAI/pull/6981
https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.