PT-2026-42667 · Pypi · Crawlee

CVE-2026-46497

·

Published

2026-05-21

·

Updated

2026-07-13

CVSS v4.0

2.3

Low

VectorAV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Crawlee versions 1.0.0 through 1.6.9
Description Crawlee is subject to a blind Server-Side Request Forgery (SSRF) when processing sitemap-derived URLs or robots.txt directives. The issue occurs when an attacker-controlled sitemap or robots.txt contains URLs pointing to internal hosts or uses non-HTTP schemes.
There are two levels of impact:
  1. Cross-host HTTP SSRF: Affects all HTTP clients. The software accepts sitemap entries and Sitemap: directives regardless of the host, allowing requests to be dispatched to internal network services such as admin panels or cloud metadata endpoints.
  2. Non-HTTP scheme SSRF: Specifically affects the CurlImpersonateHttpClient. Because nested-sitemap fetching bypasses certain validation steps, it allows the use of protocols like gopher://, file://, dict://, and ftp://. This can lead to reading local files via file:// or achieving remote code execution on internal Redis servers via gopher:// RESP-injection.
The issue resides in the following components:
  • src/crawlee/ utils/sitemap.py
  • src/crawlee/ utils/robots.py
  • src/crawlee/request loaders/ sitemap request loader.py
  • All built-in HTTP clients, specifically within the send request() and stream() functions.
Recommendations Update Crawlee to version 1.7.0. As a temporary mitigation, restrict the crawler's network egress to prevent it from reaching internal services or sensitive local endpoints.

Exploit

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-46497
GHSA-3R75-XC34-5F44
PYSEC-2026-2430

Affected Products

Crawlee