Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

crawlee

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.3PyPIAmendedPublished

    Crawlee for Python: SSRF via sitemap-derived URLs

    CVE-2026-46497 · GHSA-3r75-xc34-5f44

    Affected
    • PyPI crawlee >= 1.0.0, < 1.7.0
    Fixed in
    1.7.0· Vendor fix available
    Issue
    - Vulnerability type: Blind SSRF - Affected components: src/crawlee/utils/sitemap.py, src/crawlee/utils/robots.py, src/crawlee/requestloaders/sitemaprequestloader.py, and all built-in HTTP clients. - Trigger: an attacker-controlled sitemap or robots.txt containing a URL that points to an internal host (layer 1) or uses a non-http scheme (layer 2). Two-layer SSRF via sitemap-derived URLs: 1) Cross-host HTTP SSRF Base case, affects every HTTP client. Sitemap entries and robots.txt Sitemap: directives were accepted regardless of the host they pointed to. A sitemap on example.com could push http://internal.corp/admin into the crawler's queue, and the configured HTTP client would dispatch the request. 2) Non-HTTP scheme SSRF Escalation, only CurlImpersonateHttpClient. Nested-sitemap fetching dispatches the URL straight to the HTTP client, bypassing the Request construction step where Pydantic enforces http(s). Combined with the libcurl-backed CurlImpersonateHttpClient, this lets…

    Recommended action: Upgrade to 1.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →