I found a security flaw in IBM's Langflow and CrewAI that lets attackers reach internal networks. I've been auditing AI agent frameworks. These tools let language models browse the web, run shell commands, call APIs. Big attack surface. I wanted to see how they handle URL fetching.
I pulled up CrewAI's source and found their SSRF guard. Standard setup: extract hostname with urlparse, check against a denylist, then fetch with requests. But requests uses urllib3 under the hood. Two different URL parsers touching the same input.
That's a code smell. If they disagree on edge cases, the guard checks one thing while the client connects to another.
I started fuzzing: unicode, null bytes, double encoding. Nothing. Then I tried special characters in the authority section. Backslash:
http://127.0.0.1:8080\@1.1.1.1/
