[BUG] SeleniumScrapingTool has no SSRF protection — LLM-controlled URLs reach private/internal addresses (CVE-2026-112308)

オープン
  • 何か問題がありますか？
#9,261 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@gangjig がすでに取り組んでいます。

2026年11月8日 から。

  • #9262 @gangjig による — オープン

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
25/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
python
領域
backend, security

調査の方向性

Read lib/crewai-tools/src/crewai_tools/tools/selenium_scraping_tool/selenium_scraping_tool.py and compare its URL handling with the sibling scraping tools that use validate_url from crewai_tools.security.safe_path. The issue describes validation at schema validation, fixed URL construction, and _make_request, with regression tests for private URL rejection. Done means private, loopback, link-local, and reserved addresses are rejected before browser navigation; linked PR #9262 is already open.

索引モデルが issue の本文から書いたものです。

説明

Description

SeleniumScrapingTool accepts any http(s) URL and navigates a local headless Chrome to it, with no private/reserved-IP validation:

  • lib/crewai-tools/src/crewai_tools/tools/selenium_scraping_tool/selenium_scraping_tool.py contains no call to validate_url (the helper in crewai_tools.security.safe_path that sibling tools already use).
  • _make_request performs only a ^https?:// regex check before self.driver.get(url).
  • When the URL is fixed at construction time, the args_schema is swapped for a Fixed schema without a website_url field, bypassing format validation as well.

This means an LLM-controlled website_url can reach loopback, RFC1918, link-local, and cloud metadata addresses (e.g. 169.254.169.254) from the host running the crew, and the fetched content is returned into the LLM's output. This is tracked as CVE-2026-112308 (CWE-918; CVSS 3.1 7.4 / 4.0 8.3). The CVE lists affected versions as crewai-tools ≤ 1.15.28, but the code on current main is still unguarded, so later versions appear affected as well.

Other scraping tools in the same package (e.g. FirecrawlScrapeWebsiteTool, ScrapflyScrapeWebsiteTool, and ScrapeWebsiteTool via safe_get) already validate URLs with validate_url before fetching — Selenium is the remaining gap in that cluster.

Prior attempt

PR #6870 (by @SashaMIT) implemented exactly this fix in August 2026, but it was auto-closed on 2026-09-17 with the needs-issue label because, as a first-time-contributor PR, it did not reference an open issue. The fix was never reviewed on its merits and the author did not return to re-file it, so I am opening this issue first, as the contributing process asks. I have a fix ready that follows the same approach (route the URL through validate_url at schema validation, fixed-URL construction, and _make_request, plus regression tests for private-URL rejection) and will open a PR referencing this issue.

Expected behavior

SeleniumScrapingTool should reject URLs that resolve to private, loopback, link-local, or otherwise reserved addresses — consistent with the other scraping tools — before any browser navigation happens.

主要言語
Python
スター
60.6k
フォーク
9.1k
平均マージ
1日 2時間
マージ済み PR（30日）
214

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

crewAIInc/crewAI のほかの issue

crewAIInc/crewAI の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。