Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| unclecode | Crawl4AI | before 0.8.0 | 0.8.0 | Patch available | CNA |
| — | Crawl4AI (PyPI) | before 0.8.0 | 0.8.0 | Patch available | GHSA-5882-5rx9-xgxp |
- Crawl4AI Vendorunclecode Affected before 0.8.0 Fixed in 0.8.0 Patch available CNA
- Crawl4AI (PyPI) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-5882-5rx9-xgxp
Remediation
- Fix · CNA Crawl4AI (unclecode) Fixed in 0.8.0
- Fix · GHSA-5882-5rx9-xgxp Crawl4AI (PyPI) Fixed in 0.8.0 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
unclecode Crawl4AI 0.8.0
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-21208 Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL HandlingPriority MEDIUM 50
Timeline
- 2026-10-02 Threatist record created from CVE-2026-26216
- 2026-10-03 Alias added: GHSA-5882-5rx9-xgxp
- 2026-10-04 EPSS moved to the 90th–95th percentile
References
Advisory 2
Other 5
- https://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md
- https://github.com/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-33.yaml
- https://github.com/unclecode/crawl4ai
- https://github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/blog/release-v0.8.0.md
- https://github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/migration/v0.8.0-upgrade-guide.md
More unclecode Crawl4ai vulnerabilities
- TI-2026-38760 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API CVSS 3.1CRITICAL 10.0
- TI-2026-40630 Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key CVSS 4.0CRITICAL 9.3
- TI-2026-41423 Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args CVSS 3.1CRITICAL 10.0
- TI-2026-21208 Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling CVSS 4.0CRITICAL 9.2
- TI-2026-40631 Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints CVSS 4.0CRITICAL 9.2
- TI-2025-20742 Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-26216 · CVE Program
- CVE-2026-26216 · NVD
- FIRST EPSS
- GHSA-5882-5rx9-xgxp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences