crewai-tools contains a server‑side request forgery flaw in the SeleniumScrapingTool that allows an attacker to cause the tool to fetch internal resources. The vulnerability exists because validate_url never blocks private‑address references, so controlled input can be used to direct headless Chrome to loopback, RFC1918, or cloud metadata addresses, exposing sensitive data and credentials.

The flaw affects crewAI Inc’s crewai-tools up through version 1.15.28. Any installation of crewai-tools that has not been updated beyond 1.15.28 is vulnerable.

The CVSS score of 8.3 marks this a high‑severity issue with potential compromise of confidentiality. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of input validation makes exploitation straightforward if an attacker can inject tool parameters via prompt injection. The likely attack vector is via untrusted agent‑tool input that is passed directly to SeleniumScrapingTool, allowing the attacker to craft arbitrary URLs to internal endpoints.