Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

18 records

Vendor: unclecode Component: Crawl4ai Clear all filters
TI-2026-40625 CVE-2026-56260 · GHSA-r9hw-78q5-478g

Crawl4AI - Arbitrary File Write via output_path Parameter

Priority MEDIUM 45

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00648 Published 2026-07-12 Fixed in 0.8.7 CWE-22
TI-2026-40626 CVE-2026-56261 · GHSA-f23g-2f38-gg94

Crawl4AI - Server-Side Request Forgery via Webhook URLs

Priority MEDIUM 46

Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00513 Published 2026-07-10 Fixed in 0.8.7 CWE-918
TI-2026-40629 CVE-2026-56264 · GHSA-g2pv-76hm-j4x9

Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint

Priority MEDIUM 42

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser contex…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00488 Published 2026-06-30 Fixed in 0.8.7 CWE-94
TI-2026-40628 CVE-2026-56263 · GHSA-53rg-46cm-4g2v

Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard

Priority LOW 24

Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00344 Published 2026-06-23 Fixed in 0.8.7 CWE-79
TI-2026-40623 CVE-2026-56258 · GHSA-wx2c-3cp2-f6qw

Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU

Priority MEDIUM 43

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-t…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00912 Published 2026-06-23 Fixed in 0.8.8 CWE-22
TI-2026-40631 CVE-2026-56266 · GHSA-365w-hqf6-vxfg

Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

Priority MEDIUM 48

Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00476 Published 2026-06-22 Fixed in 0.8.7 CWE-918
TI-2026-40630 CVE-2026-56265 · GHSA-8qrg-7j2f-rf2h

Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

Priority HIGH 81

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02639 Published 2026-06-21 Fixed in 0.8.7 CWE-798