Crawl4ai (Unclecode) - vulnerabilities (CVEs)
17 CVEs, 4 in the last 30 days, 2 known versions, newest CVE from 2026-10-22. Vendor: Unclecode.
CVEs of Crawl4ai
- CVE-2026-115508 - CVSS 7.1 (high), 2026-10-22: Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients…
- CVE-2026-109239 - CVSS 6.9 (medium), 2026-10-12: Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker…
- CVE-2026-109238 - CVSS 9.2 (critical), 2026-10-12: Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling…
- CVE-2026-109237 - CVSS 8.6 (high), 2026-10-12: Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping…
- CVE-2026-91944 - CVSS 6.1 (medium), 2026-09-15: crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns…
- CVE-2026-91943 - CVSS 8.3 (high), 2026-09-15: Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with…
- CVE-2026-91942 - CVSS 5.4 (medium), 2026-09-15: crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to…
- CVE-2026-91941 - CVSS 8.7 (high), 2026-09-15: Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial…
- CVE-2026-91940 - CVSS 8.7 (high), 2026-09-15: crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to…
- CVE-2026-57572 - CVSS 10 (critical), 2026-07-06: Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args,…
- CVE-2026-57573 - CVSS 8.6 (high), 2026-07-06: Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming…
- CVE-2026-57571 - CVSS 9.6 (critical), 2026-07-06: Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken…
- CVE-2026-53753 - CVSS 10 (critical), 2026-06-23: Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST…
- CVE-2026-53754 - CVSS 7.5 (high), 2026-06-23: Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url /…
- CVE-2026-53755 - CVSS 8.6 (high), 2026-06-23: Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target…
- CVE-2026-26217 - CVSS 9.2 (critical), 2026-02-12: Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html…
- CVE-2026-26216 - CVSS 10 (critical), 2026-02-12: Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter…
