Product by Unclecode
Crawl4AI
23 known vulnerabilities in Crawl4AI (Unclecode), 0 of them actively exploited (CISA KEV).
Key figures
23
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-26216 | Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter | 10.0 | |
| Critical | CVE-2026-53753 | Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API | 10.0 | |
| Critical | CVE-2026-26217 | Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling | 8.6 | |
| High | CVE-2026-53755 | Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check | 7.5 | |
| Critical | CVE-2026-57572 | Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args | 10.0 | |
| Critical | CVE-2026-57571 | Crawl4AI arbitrary file write via download filename path traversal | 9.6 | |
| High | CVE-2026-91941 | Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy | 7.5 | |
| High | CVE-2026-91940 | crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy | 7.5 | |
| Critical | CVE-2026-109238 | Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder | 8.6 | |
| High | CVE-2026-119120 | Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name | 7.5 | |
| High | CVE-2026-109237 | Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables | 8.1 | |
| High | CVE-2026-115508 | Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields | 6.5 | |
| High | CVE-2026-91943 | Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy | 7.7 | |
| High | CVE-2026-57573 | Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint | 8.6 | |
| High | CVE-2026-119119 | Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields | 7.5 | |
| High | CVE-2026-119118 | Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags | 6.5 | |
| High | CVE-2026-53754 | Crawl4AI: Server-Side Request Forgery (SSRF) | 7.5 | |
| Medium | CVE-2026-109239 | Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch | 5.3 | |
| Medium | CVE-2026-112363 | Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo | 5.3 | |
| Medium | CVE-2026-119122 | Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check | 5.3 | |
| Medium | CVE-2026-91944 | crawl4ai before 0.9.3 DOM-based XSS via Playground UI | 6.1 | |
| Medium | CVE-2026-119121 | Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for | 4.3 | |
| Medium | CVE-2026-91942 | crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML | 5.4 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 26sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,