Threats affecting pkg:github/crewaiinc/crewAI

CrewAI versions prior to 1.15.17 contain a server-side request forgery (SSRF) vulnerability due to flaws in its SSRF guard and HTTP client. These components incorrectly validate URLs by checking opposite content, allowing malicious URLs to bypass protections and perform SSRF attacks, such as via the ScrapWebsiteTool. The issue is fixed in version 1.15.17.