https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:04:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326488 EUVD-2026-326488 https://cve.radiocsirt.org/vuln/euvd-2026-326488 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46497 <p>Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0.</p> <p>Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46497 https://cve.radiocsirt.org/vuln/ghsa-3r75-xc34-5f44 <p><strong>Affected:</strong> PyPI: crawlee</p> <p>## Overview</p> <p>- **Vulnerability type:** Blind SSRF - **Affected components:** `src/crawlee/_utils/sitemap.py`, `src/crawlee/_utils/robots.py`, `src/crawlee/request_loaders/_sitemap_request_loader.py`, and all built-in HTTP clients. - **Trigger:** an attacker-controlled sitemap or `robots.txt` containing a URL that points to an internal host (layer 1) or uses a non-http scheme (layer 2).</p> <p>Two-layer SSRF via sitemap-derived URLs:</p> <p>### 1) Cross-host HTTP SSRF</p> <p>Base case, affects every HTTP client.** Sitemap entries and `robots.txt` `Sitemap:` directives were accepted regardless of the host they pointed to. A sitemap on `example.com` could push `http://internal.corp/admin` into the crawler&#39;s queue, and the configured HTTP client would dispatch the request.</p> <p>### 2) Non-HTTP scheme SSRF</p> <p>Escalation, only `CurlImpersonateHttpClient`.** Nested-sitemap fetching dispatches the URL straight to the HTTP client, bypassing the `Request` construction step where Pydantic enforces `http(s)`. Combined with the libcurl-backed `CurlImpersonateHttpClient`, this lets `gopher://`, `file://`, `dict://`, `ftp://`, etc., through.</p> <p>## Root cause</p> <p>Crawlee already validates URL schemes through Pydantic&#39;s `AnyHttpUrl` (via `validate_http_url` in `src/crawlee/_utils/urls.py`) wherever a crawl target is materialised as a `Request`: the `Request.url` field is declared as `Annotated[str, BeforeValidator(validate_http_url), Field(frozen=True)]`. Anything that becomes a `Request` is therefore guaranteed to be…</p> <p><strong>Affected:</strong> PyPI: crawlee</p> <p>## Overview</p> <p>- **Vulnerability type:** Blind SSRF - **Affected components:** `src/crawlee/_utils/sitemap.py`, `src/crawlee/_utils/robots.py`, `src/crawlee/request_loaders/_sitemap_request_loader.py`, and all built-in HTTP clients. - **Trigger:** an attacker-controlled sitemap or `robots.txt` containing a URL that points to an internal host (layer 1) or uses a non-http scheme (layer 2).</p> <p>Two-layer SSRF via sitemap-derived URLs:</p> <p>### 1) Cross-host HTTP SSRF</p> <p>Base case, affects every HTTP client.** Sitemap entries and `robots.txt` `Sitemap:` directives were accepted regardless of the host they pointed to. A sitemap on `example.com` could push `http://internal.corp/admin` into the crawler&#39;s queue, and the configured HTTP client would dispatch the request.</p> <p>### 2) Non-HTTP scheme SSRF</p> <p>Escalation, only `CurlImpersonateHttpClient`.** Nested-sitemap fetching dispatches the URL straight to the HTTP client, bypassing the `Request` construction step where Pydantic enforces `http(s)`. Combined with the libcurl-backed `CurlImpersonateHttpClient`, this lets `gopher://`, `file://`, `dict://`, `ftp://`, etc., through.</p> <p>## Root cause</p> <p>Crawlee already validates URL schemes through Pydantic&#39;s `AnyHttpUrl` (via `validate_http_url` in `src/crawlee/_utils/urls.py`) wherever a crawl target is materialised as a `Request`: the `Request.url` field is declared as `Annotated[str, BeforeValidator(validate_http_url), Field(frozen=True)]`. Anything that becomes a `Request` is therefore guaranteed to be…</p> https://cve.radiocsirt.org/vuln/ghsa-3r75-xc34-5f44 https://cve.radiocsirt.org/vuln/pysec-2026-2430 <p><strong>Affected:</strong> PyPI: crawlee</p> <p>## Overview</p> <p>- **Vulnerability type:** Blind SSRF - **Affected components:** `src/crawlee/_utils/sitemap.py`, `src/crawlee/_utils/robots.py`, `src/crawlee/request_loaders/_sitemap_request_loader.py`, and all built-in HTTP clients. - **Trigger:** an attacker-controlled sitemap or `robots.txt` containing a URL that points to an internal host (layer 1) or uses a non-http scheme (layer 2).</p> <p>Two-layer SSRF via sitemap-derived URLs:</p> <p>### 1) Cross-host HTTP SSRF</p> <p>Base case, affects every HTTP client.** Sitemap entries and `robots.txt` `Sitemap:` directives were accepted regardless of the host they pointed to. A sitemap on `example.com` could push `http://internal.corp/admin` into the crawler&#39;s queue, and the configured HTTP client would dispatch the request.</p> <p>### 2) Non-HTTP scheme SSRF</p> <p>Escalation, only `CurlImpersonateHttpClient`.** Nested-sitemap fetching dispatches the URL straight to the HTTP client, bypassing the `Request` construction step where Pydantic enforces `http(s)`. Combined with the libcurl-backed `CurlImpersonateHttpClient`, this lets `gopher://`, `file://`, `dict://`, `ftp://`, etc., through.</p> <p>## Root cause</p> <p>Crawlee already validates URL schemes through Pydantic&#39;s `AnyHttpUrl` (via `validate_http_url` in `src/crawlee/_utils/urls.py`) wherever a crawl target is materialised as a `Request`: the `Request.url` field is declared as `Annotated[str, BeforeValidator(validate_http_url), Field(frozen=True)]`. Anything that becomes a `Request` is therefore guaranteed to be…</p> <p><strong>Affected:</strong> PyPI: crawlee</p> <p>## Overview</p> <p>- **Vulnerability type:** Blind SSRF - **Affected components:** `src/crawlee/_utils/sitemap.py`, `src/crawlee/_utils/robots.py`, `src/crawlee/request_loaders/_sitemap_request_loader.py`, and all built-in HTTP clients. - **Trigger:** an attacker-controlled sitemap or `robots.txt` containing a URL that points to an internal host (layer 1) or uses a non-http scheme (layer 2).</p> <p>Two-layer SSRF via sitemap-derived URLs:</p> <p>### 1) Cross-host HTTP SSRF</p> <p>Base case, affects every HTTP client.** Sitemap entries and `robots.txt` `Sitemap:` directives were accepted regardless of the host they pointed to. A sitemap on `example.com` could push `http://internal.corp/admin` into the crawler&#39;s queue, and the configured HTTP client would dispatch the request.</p> <p>### 2) Non-HTTP scheme SSRF</p> <p>Escalation, only `CurlImpersonateHttpClient`.** Nested-sitemap fetching dispatches the URL straight to the HTTP client, bypassing the `Request` construction step where Pydantic enforces `http(s)`. Combined with the libcurl-backed `CurlImpersonateHttpClient`, this lets `gopher://`, `file://`, `dict://`, `ftp://`, etc., through.</p> <p>## Root cause</p> <p>Crawlee already validates URL schemes through Pydantic&#39;s `AnyHttpUrl` (via `validate_http_url` in `src/crawlee/_utils/urls.py`) wherever a crawl target is materialised as a `Request`: the `Request.url` field is declared as `Annotated[str, BeforeValidator(validate_http_url), Field(frozen=True)]`. Anything that becomes a `Request` is therefore guaranteed to be…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2430