crewai-tools
Framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.
View on Github
Activity
- Latest release
- 4d ago
- Total releases
- 222
- Cadence
- ~daily
- Last 12 months
- 126
Reach
- Stars
- 58.5k
Details
- First release
- Jan 15, 2024
Releases
| Version | Released | |
|---|---|---|
1.15.21
patch
| ||
1.15.20
patch
| ||
1.15.19
patch
| ||
1.15.18
patch
| ||
1.15.17
patch
| ||
1.15.16
patch
| ||
1.15.15
patch
| ||
1.15.14
patch
| ||
1.15.13
patch
| ||
1.15.12
patch
| ||
1.15.11
patch
| ||
1.15.10
patch
| ||
1.15.9
patch
| ||
1.15.8
patch
| ||
1.15.7
patch
| ||
1.15.7a1
pre
| ||
1.15.6
patch
| ||
1.15.5
patch
| ||
1.15.4
patch
| ||
1.15.3
patch
| ||
1.15.3a2
pre
| ||
1.15.3a1
pre
| ||
1.15.2
patch
| ||
1.15.2a2
pre
| ||
1.15.2a1
pre
| ||
1.15.1
patch
| ||
1.15.1a1
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.15.0
minor
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.8a5
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.8a4
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.8a3
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.8a2
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.8a1
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.8a0
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.7
patch
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.7rc2
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.7rc1
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.7a4
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.7a3
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.7a2
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.7a1
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.6
patch
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.6a2
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.6a1
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.5
patch
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.5a7
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.5a6
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.5a5
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.5a4
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev | ||
1.14.5a3
pre
1 CVE
CVE-2026-62240
PYSEC-2026-3819
GHSA-mr4r-hcgx-8p4h
Sep 10, 2026
crewai-tools SSRF redirect bypass exposes internal services
High
Network
Low
None
CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. Affected versions
0.0.1
0.0.10
0.0.11
0.0.12
0.0.14
0.0.15
0.0.16
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7
+ 277 more Show less
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.4
0.14.0
0.17.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.25.7
0.25.8
0.3.0
0.32.0
0.32.1
0.33.0
0.36.0
0.37.0
0.38.0
0.38.1
0.4.0
0.4.1
0.4.25
0.4.26
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.40.0
0.40.1
0.42.0
0.42.2
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.51.0
0.51.1
0.55.0
0.58.0
0.59.0
0.60.0
0.62.0
0.62.1
0.62.2
0.62.3
0.65.0
0.69.0
0.71.0
0.73.0
0.73.1
0.74.0
0.74.1
0.75.0
0.76.0
0.8.0
0.8.3
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0b1
1.0.0b2
1.0.0b3
1.1.0
1.10.0
1.10.0a1
1.10.1
1.10.1.dev20260307
1.10.1.dev20260309
1.10.1.dev20260310
1.10.1.dev20260311
1.10.1a0
1.10.1a1
1.10.1b0
1.10.1b1
1.10.2a1
1.10.2a1.dev20260312
1.10.2a1.dev20260313
1.10.2rc1
1.10.2rc2
1.10.2rc2.dev20260314
1.10.2rc2.dev20260315
1.11.0
1.11.0.dev20260319
1.11.0.dev20260320
1.11.0.dev20260321
1.11.0.dev20260323
1.11.0rc1
1.11.0rc1.dev20260316
1.11.0rc1.dev20260317
1.11.0rc2
1.11.0rc2.dev20260318
1.11.1
1.11.1.dev20260324
1.11.1.dev20260325
1.12.0
1.12.0a1
1.12.0a2
1.12.0a3
1.12.1
1.12.1.dev20260326
1.12.2
1.13.0
1.13.0.dev20260403
1.13.0.dev20260404
1.13.0.dev20260406
1.13.0a1
1.13.0a2
1.13.0a3
1.13.0a4
1.13.0a4.dev20260401
1.13.0a5
1.13.0a6
1.13.0a6.dev20260402
1.13.0a7
1.13.0rc1
1.13.0rc1.dev20260327
1.13.0rc1.dev20260328
1.13.0rc1.dev20260331
1.14.0
1.14.0.dev20260408
1.14.0a2
1.14.0a3
1.14.0a3.dev20260407
1.14.0a4
1.14.1
1.14.1rc1
1.14.2
1.14.2.dev20260418
1.14.2.dev20260420
1.14.2a1
1.14.2a1.dev20260409
1.14.2a1.dev20260410
1.14.2a2
1.14.2a2.dev20260411
1.14.2a2.dev20260413
1.14.2a3
1.14.2a3.dev20260414
1.14.2a4
1.14.2a4.dev20260415
1.14.2a5
1.14.2rc1
1.14.2rc1.dev20260416
1.14.2rc1.dev20260417
1.14.3
1.14.3.dev20260425
1.14.3.dev20260428
1.14.3.dev20260429
1.14.3a1
1.14.3a1.dev20260421
1.14.3a2
1.14.3a2.dev20260422
1.14.3a3
1.14.3a3.dev20260423
1.14.3a3.dev20260424
1.14.4
1.14.4.dev20260501
1.14.4a1
1.14.4a1.dev20260430
1.14.5
1.14.5.dev20260519
1.14.5.dev20260520
1.14.5a1
1.14.5a1.dev20260502
1.14.5a1.dev20260503
1.14.5a1.dev20260504
1.14.5a2
1.14.5a2.dev20260505
1.14.5a3
1.14.5a3.dev20260507
1.14.5a3.dev20260508
1.14.5a4
1.14.5a4.dev20260509
1.14.5a4.dev20260512
1.14.5a5
1.14.5a5.dev20260513
1.14.5a5.dev20260514
1.14.5a6
1.14.5a6.dev20260516
1.14.5a7
1.14.6
1.14.6.dev20260529
1.14.6.dev20260530
1.14.6.dev20260601
1.14.6.dev20260602
1.14.6.dev20260603
1.14.6a1
1.14.6a1.dev20260521
1.14.6a1.dev20260522
1.14.6a1.dev20260523
1.14.6a1.dev20260526
1.14.6a1.dev20260527
1.14.6a2
1.14.6a2.dev20260528
1.14.7
1.14.7.dev20260612
1.14.7.dev20260613
1.14.7.dev20260614
1.14.7.dev20260615
1.14.7.dev20260616
1.14.7.dev20260617
1.14.7a1
1.14.7a1.dev20260604
1.14.7a1.dev20260605
1.14.7a2
1.14.7a2.dev20260606
1.14.7a3
1.14.7a3.dev20260609
1.14.7a4
1.14.7a4.dev20260610
1.14.7rc1
1.14.7rc2
1.14.7rc2.dev20260611
1.14.8a0
1.14.8a0.dev20260618
1.14.8a1
1.14.8a2
1.14.8a2.dev20260619
1.14.8a2.dev20260620
1.14.8a2.dev20260623
1.14.8a3
1.14.8a3.dev20260624
1.14.8a4
1.14.8a5
1.14.8a5.dev20260625
1.15.0
1.15.0.dev20260626
1.15.1.dev20260627
1.15.1.dev20260628
1.15.1.dev20260630
1.15.1a1
1.2.0
1.2.1
1.3.0
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.9.0
1.9.1
1.9.2
1.9.3
Fixed in
1.15.1
References
Updated Sep 10, 2026 · Source: OSV.dev |
1–50 of 222