CVE-2026-91942 is a DOM-based XSS vulnerability in the Docker Playground UI of crawl4ai before version 0.9.3. The vulnerability arises from improper neutralization of untrusted input assigned to element.innerHTML. Exploitation involves malicious PDFs with embedded event-handler markup that execute JavaScript in the context of the Playground origin, enabling attackers to steal API tokens from sessionStorage and abuse authenticated API access.

Successful exploitation allows attackers to execute arbitrary JavaScript in the affected web application's origin, leading to theft of API tokens from sessionStorage. This can result in unauthorized API access and abuse under the victim's authenticated session. The vulnerability has a CVSS 4.0 base score of 5.1, indicating a medium severity impact with network attack vector, low attack complexity, and no privileges required.

A fix is available in crawl4ai version 0.9.3 and later. Users should upgrade to version 0.9.3 or newer to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the affectedVersions data. Until patched, avoid processing untrusted PDFs in the Docker Playground UI and consider restricting access to trusted users only.