CR
Product
crawl4ai
18
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Severity mix
Critical 4High 9Medium 5Low 0
Watch
Add crawl4ai to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-57572 | 10.0 | Jul 6 | Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args Affected: < 0.9.0 |
| CVE-2026-53753 | 10.0 | Jun 23 | Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API Affected: < 0.8.7 |
| CVE-2026-26216 | 10.0 | Feb 12 | Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter Affected: before 0.8.0 |
| CVE-2026-57571 | 9.6 | Jul 6 | Crawl4AI arbitrary file write via download filename path traversal Affected: < 0.9.0 |
| CVE-2026-109238 | 8.6 | Oct 12 | Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder Affected: 0.7.0 before 0.9.4 |
| CVE-2026-57573 | 8.6 | Jul 6 | Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint Affected: < 0.9.0 |
| CVE-2026-109237 | 8.1 | Oct 12 | Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables Affected: 0.9.0 before 0.9.4 |
| CVE-2026-91943 | 7.7 | Sep 15 | Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy Affected: before 0.9.3 |
| CVE-2026-91941 | 7.5 | Sep 15 | Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy Affected: before 0.9.3 |
| CVE-2026-91940 | 7.5 | Sep 15 | crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy Affected: 0.9.0 before 0.9.3 |
| CVE-2026-53754 | 7.5 | Jun 23 | Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) Affected: < 0.8.8 |
| CVE-2026-53755 | 7.5 | Jun 23 | Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check Affected: < 0.8.9 |
| CVE-2026-26217 | 7.5 | Feb 12 | Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling Affected: before 0.8.0 |
| CVE-2026-115508 New | 6.5 | Oct 22 | Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields Affected: 0.7.0 before 0.9.5 |
| CVE-2026-91944 | 6.1 | Sep 15 | crawl4ai before 0.9.3 DOM-based XSS via Playground UI Affected: before 0.9.3 |
| CVE-2026-91942 | 5.4 | Sep 15 | crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML Affected: before 0.9.3 |
| CVE-2026-112363 | 5.3 | Oct 19 | Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo Affected: 0.8.7 through 0.9.5 |
| CVE-2026-109239 | 5.3 | Oct 12 | Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch Affected: before 0.9.4 |
Showing 18