Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: unclecode crawl4ai 0.9.3 Clear all filters
TI-2026-62079 CVE-2026-91944 · GHSA-hr2f-r8c5-ggxp

crawl4ai before 0.9.3 DOM-based XSS via Playground UI

Priority LOW 29

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HT…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00263 Published 2026-09-15 Fixed in 0.9.3 CWE-79
TI-2026-62078 CVE-2026-91943 · GHSA-92qr-m259-5rqq

Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Priority HIGH 69

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00354 Published 2026-09-15 Fixed in 0.9.3 CWE-918
TI-2026-62077 CVE-2026-91942 · GHSA-xjmx-xxmr-qf54

crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML

Priority MEDIUM 56

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00237 Published 2026-09-15 Fixed in 0.9.3 CWE-79
TI-2026-62076 CVE-2026-91941 · GHSA-35gf-m9jx-8qmx

Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Priority MEDIUM 44

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00488 Published 2026-09-15 Fixed in 0.9.3 CWE-400
TI-2026-62075 CVE-2026-91940 · GHSA-86m6-ccmv-j88p

crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy

Priority HIGH 77

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0046 Published 2026-09-15 Fixed in 0.9.3 CWE-22