Threats affecting pkg:pypi/crawl4ai

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for, bypassing the js_code block to alter page state and returned crawl content.

CVE-2026-119120 is a deserialization vulnerability in crawl4ai versions 0.9.0 up to but not including 0.9.5. The flaw allows authenticated clients to manipulate the CosineStrategy model_name field in Docker API request bodies to specify arbitrary HuggingFace models. This can lead to loading malicious pickle files that execute arbitrary Python code under PyTorch versions below 2.6 or cause resource exhaustion. The issue is fixed in version 0.9.5.

Crawl4AI versions before 0.9.5 have a denial of service vulnerability in the Docker API server. The vulnerability arises because the _clamp_untrusted() function does not properly limit certain delay parameters in untrusted CrawlerRunConfig inputs. This allows unauthenticated attackers to send large values to specific endpoints, exhausting resources and blocking other crawling operations.

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.

Crawl4AI versions 0.7.0 up to but not including 0.9.5 contain a vulnerability involving inefficient regular expression complexity in the Docker API server. Authenticated API clients can supply unbounded regular expressions in /crawl request bodies, which may cause catastrophic backtracking and freeze the entire server, including the /health endpoint. This issue is fixed in version 0.9.5.

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details.

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.