CVE-2026-115411: crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
crawlseoto a version that resolves this vulnerability.Fixed in 0.2.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker who can add a domain and trigger a crawl can exploit the vulnerability. The attacker-controlled domain can resolve to an internal or otherwise restricted address.
What can an attacker access through a successful exploit?
The crawler can be induced to reach internal services or cloud metadata endpoints, including 169.254.169.254. Crawl results can expose the fetched page's title, description, headings, status code, and links, enabling internal network reconnaissance.
Are DNS-based protections sufficient?
No. Although the crawler validates addresses, it does not pin the validated address for the outbound connection, allowing a TOCTOU DNS rebinding bypass. Its private-IP check also misses multiple reserved IPv4 and IPv6 ranges.
Which versions are affected?
Versions of npm/crawlseo before 0.2.4 are affected. Version 0.2.4 is identified as the release boundary for this issue.