GHSA-wm69-2pc3-rmmf

Affected versions of the Crawl4AI package are vulnerable to Server-Side Request Forgery (SSRF) due to inadequate destination validation on the streaming crawl path. The `handle_stream_crawl_request` function fails to apply the `validate_url_destination` check, allowing seed URLs to be processed without ensuring they are globally routable. An attacker can exploit this vulnerability by sending a `POST /crawl/stream` request or a `POST /crawl` request with `crawler_config.stream=true` to access internal services and cloud metadata endpoints, potentially exposing sensitive information such as IAM credentials.