CVE-2026-119119

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clampuntrusted fails to cap the delaybeforereturnhtml, meandelay, and maxrange fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to...

CVE-2026-119121

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119121

Versions 0.9.0 before 0.9.5 of Crawl4AI are vulnerable to a JavaScript injection flaw within the Docker API server . The root cause allows authenticated API clients to execute arbitrary JavaScript on the crawl page by injecting quotes into the css_selector field or providing js: conditions in the...

CVE-2026-119121

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

EUVD-2026-113188

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119119 Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clampuntrusted fails to cap the delaybeforereturnhtml, meandelay, and maxrange fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to...

CVE-2026-119119 Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clampuntrusted fails to cap the delaybeforereturnhtml, meandelay, and maxrange fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to...

CVE-2026-119119

Crawl4AI versions before 0.9.5 are vulnerable to a Denial of Service (DoS) attack within the Docker API server. The root cause is a failure in the _clamp_untrusted() function to properly cap the delay_before_return_html, mean_delay, and max_range fields in untrusted CrawlerRunConfig bodies. An un...

CVE-2026-119119

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clampuntrusted fails to cap the delaybeforereturnhtml, meandelay, and maxrange fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to...

EUVD-2026-113186

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clampuntrusted fails to cap the delaybeforereturnhtml, meandelay, and maxrange fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to...

CVE-2026-119121: unclecode crawl4ai: Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows…

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119119: unclecode crawl4ai: Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted()…

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clampuntrusted fails to cap the delaybeforereturnhtml, meandelay, and maxrange fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to...

UncleCode Crawl4AI code injection vulnerability

UncleCode Crawl4AI versions prior to 0.9.0 through 0.9.5 contain a code injection vulnerability. This flaw stems from improper handling of the cssselector and waitfor fields by the Docker API server. Attackers can inject quotes or js: conditions to bypass the jscode block, allowing authenticated...

PT-2026-132352

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css selector and wait for fields. Attackers can inject quotes into css selector or supply js:...

UncleCode Crawl4AI resource management error vulnerability

UncleCode Crawl4AI versions prior to 0.9.5 contain a resource management error vulnerability. This flaw arises because in the Docker API server, clampuntrusted fails to restrict the delaybeforereturnhtml, meandelay, and maxrange fields within untrusted CrawlerRunConfig requests. Unauthenticated...

PT-2026-132350

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where clamp untrusted fails to cap the delay before return html, mean delay, and max range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stre...

CVE-2026-115508

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...