Threats tagged 'ghsa-6fxw-998x-jq4q'

Crawl4AI versions from 0.9.0 up to but not including 0.9.5 contain a JavaScript injection vulnerability in the Docker API server. This flaw allows authenticated API clients to execute arbitrary JavaScript on the crawl page by exploiting the allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or use js: conditions in wait_for to bypass the js_code block, altering the page state and the crawl content returned.