Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter

🗓️ 16 Jan 2026 20:59:16Reported by GitHub Advisory DatabaseType

Crawl4AI Docker API is vulnerable to remote code execution via the hooks parameter, enabling arbitrary commands.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-26216	12 Feb 202615:31	–	attackerkb
Circl	CVE-2026-26216	12 Feb 202617:30	–	circl
CNNVD	Crawl4AI 代码注入漏洞	12 Feb 202600:00	–	cnnvd
CVE	CVE-2026-26216	12 Feb 202615:31	–	cve
Cvelist	CVE-2026-26216 Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter	12 Feb 202615:31	–	cvelist
GitLab Advisory Database	Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter	16 Jan 202600:00	–	gitlab
NVD	CVE-2026-26216	12 Feb 202616:16	–	nvd
OSV	GHSA-5882-5RX9-XGXP Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter	16 Jan 202620:59	–	osv
OSV	PYSEC-2026-33	12 Feb 202616:16	–	osv
Positive Technologies	PT-2026-7855	16 Jan 202600:00	–	ptsecurity

Vulners

Node

Source	Link
github	www.github.com/unclecode/crawl4ai/security/advisories/GHSA-5882-5rx9-xgxp
github	www.github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/blog/release-v0.8.0.md
github	www.github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/migration/v0.8.0-upgrade-guide.md
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-26216
github	www.github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md
vulncheck	www.vulncheck.com/advisories/crawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameter
github	www.github.com/advisories/GHSA-5882-5rx9-xgxp

12 Feb 2026 20:09Current

8.6High risk

Vulners AI Score8.6

CVSS 410

CVSS 3.110

EPSS0.00126

SSVC