{"data":{"id":"81bf0219-5d31-48cd-8c1b-188ce3d78fa4","title":"CVE-2026-112308: crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows…","summary":"crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool. The tool never applies the validate_url private-address check, so attackers can make it fetch internal resources. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112308","publishedAt":"2026-10-19T16:17:06.887Z","cveId":"CVE-2026-112308","cweIds":["CWE-918"],"cvssScore":"7.4","cvssSeverity":"high","severity":"high","attackType":["prompt_injection","supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["crewai-tools","SeleniumScrapingTool","CrewAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-19T18:08:32.955Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-19T18:08:36.198Z","patchAvailable":null,"disclosureDate":"2026-10-19T16:17:06.887Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":null,"atlasIds":["AML.T0010","AML.T0051"]}}