Unclecode Crawl4Ai vulnerabilities

CVE-2026-26216 [CRITICAL] CWE-94 CVE-2026-26216: Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API dep Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execut

CVE-2026-53753 [CRITICAL] CWE-94 CVE-2026-53753: Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expres Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete s

CVE-2026-53755 [HIGH] CWE-918 CVE-2026-53755: Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoi

CVE-2026-26217 [HIGH] CWE-22 CVE-2026-26217: Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API depl Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, ap

CVE-2026-57572 [CRITICAL] CWE-88 CVE-2026-57572: Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec

CVE-2026-57571 [CRITICAL] CWE-22 CVE-2026-57571: Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler sa Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitra

CVE-2026-57573 [HIGH] CWE-918 CVE-2026-57573: Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call P

CVE-2026-109238 [HIGH] CWE-918 CVE-2026-109238: Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API cli Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and

CVE-2026-53754 [HIGH] CWE-918 CVE-2026-53754: Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_destination in deploy/docker/utils.py) used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach internal services and cloud metadata endpoints (e.g. 1

CVE-2026-109237 [HIGH] CWE-502 CVE-2026-109237: Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.

CVE-2026-91943 [HIGH] CWE-918 CVE-2026-91943: Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStra Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through

CVE-2026-91940 [HIGH] CWE-22 CVE-2026-91940: crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy w crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service ac

CVE-2026-91941 [HIGH] CWE-400 CVE-2026-91941: Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrap Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.

CVE-2026-112363 [MEDIUM] CWE-918 CVE-2026-112363: Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on por

CVE-2026-109239 [MEDIUM] CWE-918 CVE-2026-109239: Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata addresses for service discovery.

CVE-2026-91944 [MEDIUM] CWE-79 CVE-2026-91944: crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playgro crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like the page title to steal the operator's API token from s

CVE-2026-91942 [MEDIUM] CWE-79 CVE-2026-91942: crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playgrou crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.