Product by Crawl4AI

    Crawl4AI

    18 known vulnerabilities in Crawl4AI (Crawl4AI), 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    12

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Crawl4AI (Crawl4AI)
    CriticalCVE-2026-26216

    Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter

    also in 1 other product

    		10.0
    CriticalCVE-2026-53753

    Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

    also in 1 other product

    		10.0
    CriticalCVE-2026-56265

    Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

    also in 1 other product

    		9.8
    CriticalCVE-2026-26217

    Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling

    also in 1 other product

    		8.6
    HighCVE-2026-53755

    Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

    also in 1 other product

    		7.5
    CriticalCVE-2026-57572

    Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

    also in 1 other product

    		10.0
    CriticalCVE-2026-56258

    Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU

    also in 1 other product

    		8.1
    CriticalCVE-2026-57571

    Crawl4AI arbitrary file write via download filename path traversal

    also in 1 other product

    		9.6
    CriticalCVE-2026-56260

    Crawl4AI - Arbitrary File Write via output_path Parameter

    also in 1 other product

    		9.1
    CriticalCVE-2026-56261

    Crawl4AI - Server-Side Request Forgery via Webhook URLs

    also in 1 other product

    		7.5
    CriticalCVE-2026-56264

    Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint

    also in 1 other product

    		8.1
    CriticalCVE-2026-56266

    Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

    also in 1 other product

    		8.6
    MediumCVE-2026-56262

    Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server

    also in 1 other product

    		6.5
    HighCVE-2026-56259

    Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution

    also in 1 other product

    		8.2
    HighCVE-2026-57573

    Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint

    also in 1 other product

    		8.6
    HighCVE-2026-53754

    Crawl4AI: Server-Side Request Forgery (SSRF)

    also in 1 other product

    		7.5
    CriticalCVE-2025-28197

    Crawl4AI: Server-Side Request Forgery (SSRF)

    		9.1
    MediumCVE-2026-56263

    Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard

    also in 1 other product

    		6.1

    News

    All products by Crawl4AI