CVE-2026-119121

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

EUVD-2026-113188

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...

CVE-2026-119121

Versions 0.9.0 before 0.9.5 of Crawl4AI are vulnerable to a JavaScript injection flaw within the Docker API server . The root cause allows authenticated API clients to execute arbitrary JavaScript on the crawl page by injecting quotes into the css_selector field or providing js: conditions in the...

CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted cssselector and waitfor fields. Attackers can inject quotes into cssselector or supply js:...