Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Crawl4AI — Vulnerabilities & Security Advisories 25

All 25 CVE vulnerabilities found in Crawl4AI, with AI-generated Chinese analysis, references, and POCs.

This page documents known security weaknesses associated with Crawl4AI, a library designed for web crawling and data extraction. It aggregates vulnerability records that highlight flaws in the product’s implementation, configuration, or usage, providing a centralized view of potential risks. The collection includes various weakness types such as injection flaws, information disclosure, and improper access controls that may affect the integrity or confidentiality of data processed by the crawler. The time range covered spans from the earliest reported instances to the most recent updates, ensuring a comprehensive historical perspective on the security posture of this tool. By accessing this resource, users can track vendor advisories and official patches related to Crawl4AI to stay informed about critical updates. It also allows security professionals to understand specific weakness classes impacting web scraping technologies and examine the vulnerability history of Crawl4AI to assess long-term risk trends. This information supports better risk management decisions by offering detailed context on how these vulnerabilities manifest and their potential impact on systems utilizing the product. Whether investigating past incidents or monitoring emerging threats, this page serves as a factual reference for security analysts, developers, and IT administrators seeking to mitigate exposure. The data is curated to facilitate precise lookups and facilitate informed remediation strategies without overwhelming the reader with excessive technical jargon or irrelevant details.

Vendor: unclecode

CVE ID Title CVSS Severity Published
CVE-2026-109239 Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch CWE-918 5.3 Medium 2026-10-12
CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder CWE-918 8.6 High 2026-10-12
CVE-2026-109237 Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables CWE-502 8.1 High 2026-10-12
CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI CWE-79 6.1 Medium 2026-09-15
CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy CWE-918 7.7 High 2026-09-15
CVE-2026-91942 crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML CWE-79 5.4 Medium 2026-09-15
CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy CWE-400 7.5 High 2026-09-15
CVE-2026-91940 crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy CWE-22 7.5 High 2026-09-15
CVE-2026-56260 Crawl4AI - Arbitrary File Write via output_path Parameter CWE-22 9.1 Critical 2026-07-12
CVE-2026-56259 Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution CWE-200 8.2 High 2026-07-12
CVE-2026-56261 Crawl4AI - Server-Side Request Forgery via Webhook URLs CWE-918 8.6 High 2026-07-10
CVE-2026-57572 Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args CWE-88 10.0 Critical 2026-07-06
CVE-2026-57573 Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint CWE-918 8.6 High 2026-07-06
CVE-2026-57571 Crawl4AI arbitrary file write via download filename path traversal CWE-22 9.6 Critical 2026-07-06
CVE-2026-56264 Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint CWE-94 8.1 High 2026-06-30
CVE-2026-56262 Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server CWE-306 6.5 Medium 2026-06-24
CVE-2026-53753 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API CWE-94 9.8 Critical 2026-06-23
CVE-2026-53754 Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) CWE-918 7.5 High 2026-06-23
CVE-2026-53755 Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check CWE-918 8.6 High 2026-06-23
CVE-2026-56263 Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard CWE-79 6.1 Medium 2026-06-23
CVE-2026-56258 Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU CWE-22 8.1 High 2026-06-23
CVE-2026-56266 Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints CWE-918 8.6 High 2026-06-22
CVE-2026-56265 Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key CWE-798 9.8 Critical 2026-06-21
CVE-2026-26217 Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling CWE-22 8.6 High 2026-02-12
CVE-2026-26216 Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter CWE-94 10.0 Critical 2026-02-12

All 25 known CVE vulnerabilities affecting Crawl4AI with full Chinese analysis, references, and POCs where available.