CVE-2026-109238

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.

Crawl4AI before version 0.8.7 has an arbitrary file write vulnerability in the /screenshot and /pdf endpoints of the Docker API server. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to overwrite server files and cause denial of service.

Crawl4AI before version 0.9.0 has a vulnerability in the Docker API that allows injecting arguments into the Chromium browser. An attacker can use Chromium switches to replace the child process launch command, leading to arbitrary code execution in the container.

In Crawl4AI before version 0.9.0, a vulnerability allows arbitrary file write due to insufficient path confinement. An attacker can control the destination filename via Content-Disposition header or suggested filename, leading to file write outside the downloads directory. This can escalate to remote code execution.

Crawl4AI before version 0.8.7 has a vulnerability in the _safe_eval_expression() function in the computed fields feature. The AST validator only blocks attributes starting with underscore, but generator and frame object attributes (gi_frame, f_back, f_builtins) do not start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands.

Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata addresses for service discovery.

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like the page title.

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin.