Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: unclecode crawl4ai 0.9.5 Clear all filters
TI-2026-82640 CVE-2026-119122 · GHSA-3mhc-98p7-hp8w

Blind SSRF in Crawl4AI Docker server via CacheValidator freshness check

Priority HIGH 70

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0037 Published 2026-10-29 Fixed in 0.9.5 CWE-918
TI-2026-82639 CVE-2026-119121 · GHSA-6fxw-998x-jq4q

JavaScript injection in Crawl4AI via css_selector and wait_for

Priority LOW 24

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00286 Published 2026-10-29 Fixed in 0.9.5 CWE-95
TI-2026-82638 CVE-2026-119120 · GHSA-3x32-3792-pvfc

Untrusted model loading in Crawl4AI via CosineStrategy model_name

Priority HIGH 69

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00419 Published 2026-10-29 Fixed in 0.9.5 CWE-502
TI-2026-82637 CVE-2026-119119 · GHSA-wh3g-v33g-c47f

Denial of service in Crawl4AI via unbounded CrawlerRunConfig delay fields

Priority HIGH 77

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00359 Published 2026-10-29 Fixed in 0.9.5 CWE-770
TI-2026-82636 CVE-2026-119118 · GHSA-495r-f2mc-w3jj

Crawl4AI ignores certificate errors, enabling interception of crawls

Priority HIGH 69

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00186 Published 2026-10-29 Fixed in 0.9.5 CWE-295