crawl4ai vulnerabilities

CVEs whose affected-version data names the crawl4ai package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

36 CVEsRSS

GHSA-f989-c77f-r2cqHigh· 8.2

4mo ago

Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution

▾ Twilightcrawl4ai · crawl4aivia GHSA

GHSA-7cx2-g3h9-382pHigh· 8.1

4mo ago

Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server

▾ Twilightcrawl4ai · crawl4aivia GHSA

CVE-2026-53755High· 8.6PoC

4mo ago

Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

▾ Midnightcrawl4ai · crawl4aiEPSS 1.6%via GHSA

CVE-2026-26217High· 8.6PoC

8mo ago

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read ar…

▾ Midnightkidocode · crawl4aiEPSS 2.1%via NVD

CVE-2026-26216Critical· 10.0PoC

8mo ago

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was i…

▾ Abyssalkidocode · crawl4aiEPSS 6.4%via NVD

CVE-2025-28197Medium

1y ago

Crawl4AI SSRF vulnerability

▾ Sunlitcrawl4ai · crawl4aiEPSS 0.37%via OSV