Critical SSRF Vulnerabilities Discovered in Widely-Used Crawlee Web Scraping Library

Crawlee is deployed across personal projects and multi-tenant SaaS platforms monitoring hundreds of customer websites, making these SSRF vulnerabilities exceptionally dangerous. The root cause—lack of URL validation outside a single function—enables attackers to bypass security controls and exfiltrate sensitive data through multiple attack vectors. This research exposes critical blind spots in how the library sanitizes URLs before passing them to HTTP clients.