The vulnerability arises from improper neutralization of argument delimiters (CWE-88) in crawl4ai's Docker API server before version 0.9.0. Specifically, the browser_config.extra_args parameter supplied by requests was passed unchecked into Chromium's launch arguments. Attackers could inject Chromium switches such as --no-zygote to replace child-process launch commands, resulting in execution of attacker-controlled commands within the container context. Since the Docker API is unauthenticated by default, a single crafted request can achieve arbitrary command execution. This vulnerability has a CVSS 3.1 base score of 10.0 (critical) reflecting its network attack vector, no required privileges or user interaction, and complete confidentiality, integrity, and availability impact. The vulnerability is resolved in crawl4ai version 0.9.0.

Successful exploitation allows remote attackers to execute arbitrary commands inside the container running crawl4ai with the container's runtime user privileges. This can lead to full compromise of the container environment, including data theft, service disruption, or further lateral movement. The unauthenticated nature of the Docker API server by default significantly increases the risk and ease of exploitation.

Upgrade crawl4ai to version 0.9.0 or later, where this vulnerability is fixed. Since the Docker API server is unauthenticated by default, restricting access to the Docker API endpoint and implementing authentication or network-level controls can reduce exposure. Patch status is confirmed fixed in version 0.9.0.