Crawl4AI versions 0.7.0 up to but not including 0.9.5 contain a vulnerability involving inefficient regular expression complexity in the Docker API server. Authenticated API clients can supply unbounded regular expressions in /crawl request bodies, which may cause catastrophic backtracking and freeze the entire server, including the /health endpoint. This issue is fixed in version 0.9.5.
CVE-2026-109239 is a server-side request forgery (SSRF) vulnerability in crawl4ai versions before 0.9.4. It affects the RobotsParser.can_fetch function, allowing unauthenticated attackers to bypass Docker server egress controls. By enabling the check_robots_txt feature and leveraging redirects or DNS rebinding, attackers can access internal, loopback, or cloud metadata addresses for service discovery.
Crawl4AI versions from 0.7.0 up to but not including 0.9.4 contain a server-side request forgery (SSRF) vulnerability. This flaw allows API clients to cause the server to make requests to internal, private, or cloud metadata endpoints by enabling the link_preview_config feature on /crawl requests. Attackers can manipulate parameters to have the AsyncUrlSeeder fetch and return sensitive internal data. The vulnerability has a high severity with a CVSS 4.0 score of 9.2.
CVE-2026-109237 is a high-severity vulnerability in unclecode's crawl4ai software versions 0.9.0 up to but not including 0.9.4. It involves a deserialization flaw where non-admin API clients can bypass configuration restrictions by wrapping forbidden config objects in dictionary-type wrappers. This allows attackers to send a specially crafted LLMConfig with an api_token referencing environment variables via the /config/dump endpoint, enabling them to read sensitive secrets such as SECRET_KEY and provider keys. These secrets can then be used to forge admin JWT tokens, potentially escalating privileges.
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like the page title to steal the operator's API token from sessionStorage and gain full server control.
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.
Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.
Crawl4AI versions before 0.8.8 have credential exfiltration vulnerabilities in their Docker API server. Attackers can exploit unauthenticated endpoints (/md, /llm, /llm/job) by manipulating the base_url parameter and setting api_token to environment variable references, allowing them to read arbitrary environment variables. This can lead to exfiltration of sensitive data such as provider API keys and JWT SECRET_KEY, enabling authentication bypass.
Crawl4AI versions before 0.8.7 have an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The vulnerability arises because the output_path parameter does not validate input, allowing attackers to write files to arbitrary locations accessible by the application user. This can lead to overwriting server files and cause denial of service.
Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. This issue is fixed in version 0.9.0.
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0.
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitrary file write with attacker-controlled contents; the HTTP crawler path uses the response Content-Disposition filename and the browser crawler path uses the download's suggested filename. Because the written bytes are attacker-controlled, this can escalate to remote code execution. This issue is fixed in version 0.9.0.
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_destination in deploy/docker/utils.py) used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach internal services and cloud metadata endpoints (e.g. 169.254.169.254) despite the filter by encoding an internal IPv4 address inside an IPv6 transition form, or by using the IPv6 unspecified address. Because the Docker API is unauthenticated by default (jwt_enabled: false), no credentials are required. This vulnerability is fixed in 0.8.8.
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default. /crawl, /crawl/stream, and /crawl/job accept a browser_config (and crawler_config). The following all feed Chromium's egress and were unchecked: browser_config.proxy_config.server, browser_config.proxy (deprecated field), crawler_config.proxy_config.server, and --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browser_config.extra_args. This vulnerability is fixed in 0.8.9.