PyPI/crawlee CVE-2026-46497: low 2.3, EPSS 0.29%

Crawlee for Python: SSRF via sitemap-derived URLs

Action: Upgrade crawlee to 1.7.0 or later.

pip install crawlee==1.7.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2430
• nvd: CVE-2026-46497
• https://github.com/apify/crawlee-python/security/advisories/GHSA-3r75-xc34-5f44
• https://github.com/apify/crawlee-python
• https://github.com/apify/crawlee-python/releases/tag/v1.7.0
• https://pypi.org/project/crawlee
• https://github.com/advisories/GHSA-3r75-xc34-5f44

CVE-2026-46497 · published 2026-07-13T15:19:10.515048Z · modified 2026-07-13T16:32:36.501489501Z · JSON