CrewAI 1.15.1 patches SSRF security flaw, adds CLI deploy improvements

Full analysis

CrewAI released version 1.15.1 of its open-source multi-agent orchestration framework, including a security fix for a Server-Side Request Forgery (SSRF) redirect bypass in scraping fetches — a vulnerability class where an attacker tricks a server into making requests to unintended internal or external destinations. On the feature side, the release adds automatic Git repository initialization for generated projects, requires explicit CrewAI project definitions for stricter project structure, and opens the deployment page automatically after a CLI deploy command.

Additional bug fixes address deployment page link ID resolution, JSON crew template rendering, and a JSON crew version pinning issue. The SSRF fix is the most security-relevant change for agent builders, as agent frameworks that perform web scraping are a common attack surface for prompt injection and network abuse.