CVE-2026-91941

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like the page title.

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin.

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.

Crawl4AI before version 0.8.7 has an arbitrary file write vulnerability in the /screenshot and /pdf endpoints of the Docker API server. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to overwrite server files and cause denial of service.

Crawl4AI before version 0.9.0 has a vulnerability in the Docker API that allows injecting arguments into the Chromium browser. An attacker can use Chromium switches to replace the child process launch command, leading to arbitrary code execution in the container.

In Crawl4AI before version 0.9.0, a vulnerability allows arbitrary file write due to insufficient path confinement. An attacker can control the destination filename via Content-Disposition header or suggested filename, leading to file write outside the downloads directory. This can escalate to remote code execution.

Crawl4AI before version 0.8.7 has a vulnerability in the _safe_eval_expression() function in the computed fields feature. The AST validator only blocks attributes starting with underscore, but generator and frame object attributes (gi_frame, f_back, f_builtins) do not start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands.

Crawl4AI before version 0.8.8 has a credential exfiltration vulnerability via unauthenticated Docker API endpoints. Attackers can redirect LLM API calls to attacker-controlled servers and read environment variables, including API keys and JWT secrets.