Crawl4AI <= 0.8.6 - Remote Code Execution

Crawl4AI through 0.8.6 ships a Docker API server that exposes an unauthenticated /crawl endpoint. The computed field type of JsonCssExtractionStrategy evaluates a user supplied expression inside an AST based sandbox that does not restrict attribute access on generator frame objects. A generator...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

Crawl4AI < 0.8.0 - Local File Inclusion

The Crawl4AI Docker API endpoints accepted arbitrary URL schemes without an allow-list. An unauthenticated request with a file:// URL could read local files. Fixed in 0.8.0, which restricts accepted URL schemes. id: CVE-2026-26217 info: name: Crawl4AI 0.8.0 - Local File Inclusion author:...

CVE-2026-53753-Crawl4AI-RCE

CVE-2026-53753 — Crawl4AI Unauthenticated Remote Code Execution AST Sandbox Escape Pre-authentication RCE in Crawl4AI.read — returning the command's output in-band in the JSON response. | ---|--- CVE| CVE-2026-53753 Advisory| GHSA-qxjp-w3pj-48m7 Affected| Crawl4AI Deep dive: see ANALYSIS.md for a...

CVE-2026-91940-crawl4ai-Arbitrary-File-Write

CVE-2026-91940: arbitrary file write in crawl4ai through the untrusted-config gate | ---|--- CVE| CVE-2026-91940 Product| crawl4ai, 84k stars Affected| = 0.9.0, = 0.9.2 Fixed| 0.9.3 Class| CWE-22, arbitrary file write attacker-chosen directory, byte-exact content Privileges| a caller able to reac...

EXPLOIT-CVE-2026-26216

CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHSA-5882-5rx9-xgxp CVSS 10.0 · pre-auth RCE · CWE-94 Code Injection Unauthenticated remote code execution on the Crawl4AI Docker server field. This code is executed with exec inside a "homemade sandbox" — a restricted builtins dictionary...

CVE-2026-119119

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clampuntrusted fails to cap the delaybeforereturnhtml, meandelay, and maxrange fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to...

CVE-2026-119118

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read...

CVE-2026-119120

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy modelname field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python...

CVE-2026-119122

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling checkcachefreshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to...

CVE-2026-119121

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

EUVD-2026-113189

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling checkcachefreshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to...

CVE-2026-119122 Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling checkcachefreshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to...

CVE-2026-119122

Versions of Crawl4AI prior to 0.9.5 are vulnerable to a blind server-side request forgery (SSRF) within the Docker server. By enabling the check_cache_freshness option, API clients can bypass egress proxies. An attacker can cache a controlled URL and subsequently trigger the CacheValidator to per...

CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119122

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling checkcachefreshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to...

CVE-2026-119121

Versions 0.9.0 before 0.9.5 of Crawl4AI are vulnerable to a JavaScript injection flaw within the Docker API server . The root cause allows authenticated API clients to execute arbitrary JavaScript on the crawl page by injecting quotes into the css_selector field or providing js: conditions in the...

tinysuite-search (>=0.4.0, <=0.6.4) potentially affected by CVE-2026-119121 via crawl4ai (0.9.2)

crawl4ai PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on crawl4ai and may be impacted: - tinysuite-search =0.4.0, =0.6.4 Source cves: CVE-2026-119121 Source advisory: MEND:CVE-2026-119121...

CVE-2026-119121

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...