CVE-2026-115411: crawlseo 0.1.0 to before 0.2.4

Affected technology

crawlseo · 0.1.0 to before 0.2.4
crawlseo

Description’s affected range: before version 0.2.4

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality, integrity and availability impact as none.