Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: unclecode crawl4ai 0.9.4 Clear all filters
TI-2026-71055 CVE-2026-109239 · GHSA-qm8q-557r-p5w7

Blind SSRF in Crawl4AI robots.txt fetch lets attackers reach internal hosts

Priority LOW 36

Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00265 Published 2026-10-12 Fixed in 0.9.4 CWE-918
TI-2026-71054 CVE-2026-109238 · GHSA-ppj7-m7ph-jqc6

SSRF in Crawl4AI link preview lets attackers reach internal hosts

Priority LOW 39

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00298 Published 2026-10-12 Fixed in 0.9.4 CWE-918
TI-2026-71053 CVE-2026-109237 · GHSA-r6v9-2q53-jfjp

Crawl4AI config gate bypass leaks environment variables

Priority LOW 39

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00324 Published 2026-10-12 Fixed in 0.9.4 CWE-502