Crawl4AI vulnerabilities

Crawl4AI before version 0.8.7 has an arbitrary file write vulnerability in the /screenshot and /pdf endpoints of the Docker API server. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to overwrite server files and cause denial of service.

Crawl4AI before version 0.9.0 has a vulnerability in the Docker API that allows injecting arguments into the Chromium browser. An attacker can use Chromium switches to replace the child process launch command, leading to arbitrary code execution in the container.

In Crawl4AI before version 0.9.0, a vulnerability allows arbitrary file write due to insufficient path confinement. An attacker can control the destination filename via Content-Disposition header or suggested filename, leading to file write outside the downloads directory. This can escalate to remote code execution.

Crawl4AI before version 0.8.7 has a vulnerability in the _safe_eval_expression() function in the computed fields feature. The AST validator only blocks attributes starting with underscore, but generator and frame object attributes (gi_frame, f_back, f_builtins) do not start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands.

Crawl4AI before version 0.8.8 has a credential exfiltration vulnerability via unauthenticated Docker API endpoints. Attackers can redirect LLM API calls to attacker-controlled servers and read environment variables, including API keys and JWT secrets.

Crawl4AI before version 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

Crawl4AI before version 0.9.0 has an SSRF vulnerability in the Docker API streaming path. An unauthenticated remote client can send a POST request to /crawl/stream or /crawl with stream=true, pointing to an internal, private, or link-local address, and the server fetches and streams the response.

Crawl4AI before version 0.8.7 contains an arbitrary JavaScript execution vulnerability in the /execute_js endpoint of the Docker API server. An attacker can submit malicious scripts that execute in the server's browser context with disabled web security.

Crawl4AI prior to version 0.8.9 contains an SSRF vulnerability that allows an unauthenticated attacker to bypass the destination URL check and route traffic through a proxy to internal IP addresses. The attacker can exploit this flaw to access internal services and cloud metadata endpoints while providing a valid crawl URL.

Crawl4AI before version 0.8.8 has an SSRF vulnerability in the Docker API server that allows an attacker to bypass the CIDR blocklist and access internal services and cloud metadata endpoints (e.g., 169.254.169.254) by encoding an IPv4 address in an IPv6 transition form or using the IPv6 unspecified address. Since the Docker API is unauthenticated by default, no credentials are required for the attack.

Crawl4AI before version 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints, allowing unauthenticated attackers to write files outside the intended directory.

Crawl4AI before version 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem.