CVE-2026-26216
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands.
Risk Assessment
Successful exploitation leads to full server compromise, enabling arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.
Recommendation
Immediately update Crawl4AI to version 0.8.0 or later. If an update is not possible, restrict access to the Docker API and remove __import__ from the allowed builtins list.
Original NVD description (English source)
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.