PT-2026-7856

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.0 Description Crawl4AI is affected by a local file inclusion issue in its Docker API deployment. The /execute js, /screenshot, /pdf, and /html API endpoints accept file:// URLs, which allows unauthenticated remot...

Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter

A critical remote code execution vulnerability exists in the Crawl4AI Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing attackers to import arbitrary modules an...

Crawl4AI Has Local File Inclusion in Docker API via file:// URLs

A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /executejs, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem. Attack Vector: json POST /executejs "url": "file:///etc/passwd", "scripts":...

Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter

A critical remote code execution vulnerability exists in the Crawl4AI Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing attackers to import arbitrary modules an...

PT-2026-7855

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.0 Description A remote code execution flaw exists in the Docker API deployment. The '/crawl' endpoint accepts a hooks parameter containing Python code that is processed using the exec function. Because the import...

EUVD-2025-11903

Malicious code in bioql PyPI...

Server-Side Request Forgery (SSRF)

Crawl4AI is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper input validation and insufficient sanitization of user-controlled URLs in /crawl4ai/asyncdispatcher.py, allowing unauthorized internal network access...

CVE-2025-28197

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

Crawl4AI SSRF vulnerability

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

ayy (>=0.1.6, <=0.1.8), mseep-owl (0.0.2) +3 more potentially affected by CVE-2025-28197 via crawl4ai (>=0.3.731, <=0.4.24)

crawl4ai PYPI version =0.3.731, =0.1.6, =0.1.0, =0.1.0, =0.1.7.5b6 - taskcraft 0.3.0 Source cves: CVE-2025-28197 Source advisory: OSV:GHSA-445M-27CF-GR3X...

ayy (>=0.1.6, <=0.1.8), mseep-owl (0.0.2) +3 more potentially affected by CVE-2025-28197 via crawl4ai (>=0.3.731, <=0.4.24)

crawl4ai PYPI version =0.3.731, =0.1.6, =0.1.0, =0.1.0, =0.1.7.5b6 - taskcraft 0.3.0 Source cves: CVE-2025-28197 Source advisory: GHSA-445M-27CF-GR3X...

GHSA-445M-27CF-GR3X Crawl4AI SSRF vulnerability

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

Server-side Request Forgery (SSRF)

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the asyncdispatcher.py module. An attacker can manipulate the server into making arbitrary requests to internal or extern...

CVE-2025-28197

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

CVE-2025-28197

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

CVE-2025-28197

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

Crawl4AI SSRF vulnerability

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

CVE-2025-28197

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

CVE-2025-28197

Crawl4AI =0.4.247 is vulnerable to SSRF in /crawl4ai/asyncdispatcher.py...

PT-2025-17342

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.4.247 and earlier Description The issue concerns a Server-Side Request Forgery SSRF vulnerability. It is located in the /crawl4ai/async dispatcher.py file. Recommendations For versions 0.4.247 and earlier, update to a versi...