CVE-2026-109237

The Crawl4AI library (versions 0.9.0 before 0.9.4 ) is vulnerable to an untrusted-config gate bypass . This flaw allows non-admin API clients to bypass restrictions by wrapping forbidden config objects in dict-type wrappers . By sending a laundered LLMConfig with an api_token set to an environmen...