Crawlee, a web scraping and browser automation library, contains an SSRF flaw in versions prior to 1.7.0 that stems from processing URLs extracted from sitemaps. The vulnerability allows an attacker to influence the URL parameter accepted by the library, potentially causing the application to resolve and request arbitrary addresses. This could expose internal services and server resources to unintended outsiders, undermining confidentiality and potentially allowing further exploitation if the internal network is compromised.

Affected systems include the Apify Crawlee Python library, any application that imports and uses it, specifically versions 1.0.0 through 1.6.x. The issue does not affect other versions, such as 1.7.0 and newer, which have the SSRF patch applied.

With a CVSS score of 2.3 the risk is classed as low, and EPSS data is not available so exploitation likelihood cannot be quantified from public metrics. The vulnerability is not listed in CISA KEV, further indicating limited known exploitation. The likely attack vector involves an attacker supplying or manipulating a sitemap URL that the application processes, which is a typical scenario for web crawlers or automated data collection services. Consequently, any application that automatically consumes external sitemaps could be at risk if not properly isolated or constrained.