What is GHSA-x35j-64g3-fxg7?

GHSA-x35j-64g3-fxg7 is a security advisory published by GitHub Security Advisories with unknown severity. CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss...

Which CVE IDs does GHSA-x35j-64g3-fxg7 cover?

GHSA-x35j-64g3-fxg7 covers the following CVE IDs: CVE-2026-120630. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-x35j-64g3-fxg7unknown

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss...

Vendor

GitHub Security Advisories

Published

November 2, 2026

Last Modified

November 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-120630 →

📋 Description

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsiteTool.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-120630
https://github.com/crewAIInc/crewAI/pull/6981
https://docs.crewai.com/v1.15.16/en/tools/web-scraping/scrapewebsitetool
https://www.badcast.dev/blog/parser-differential-ssrf-ai-agents
https://github.com/advisories/GHSA-x35j-64g3-fxg7