Threats tagged 'ghsa-495r-f2mc-w3jj'

Crawl4AI versions before 0.9.5 have an improper certificate validation vulnerability due to Chromium launching with the --ignore-certificate-errors flag. This allows network attackers performing man-in-the-middle or DNS-based attacks to intercept crawler traffic, serve forged content, and access cookies and headers. Additionally, a hard-coded --no-sandbox flag disables sandbox protections.