What’s Vulnerable › Products

unclecode crawl4ai vulnerabilities

33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 33 published in the last 12 months.

Check whether your unclecode crawl4ai version is affected

Latest unclecode crawl4ai vulnerabilities

• CVE-2026-119122 — Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check (CVSS 5.3)
• CVE-2026-119121 — Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for (CVSS 4.3)
• CVE-2026-119120 — Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name (CVSS 7.5)
• CVE-2026-119119 — Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields (CVSS 7.5)
• CVE-2026-119118 — Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags (CVSS 6.5)
• CVE-2026-115508 — Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields (CVSS 6.5)
• CVE-2026-112363 — Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo (CVSS 5.3)
• CVE-2026-109239 — Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch (CVSS 5.3)
• CVE-2026-109238 — Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder (CVSS 8.6)
• CVE-2026-109237 — Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables (CVSS 8.1)
• CVE-2026-91944 — crawl4ai before 0.9.3 DOM-based XSS via Playground UI (CVSS 6.1)
• CVE-2026-91943 — Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy (CVSS 7.7)
• CVE-2026-91942 — crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML (CVSS 5.4)
• CVE-2026-91941 — Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy (CVSS 7.5)
• CVE-2026-91940 — crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy (CVSS 7.5)
• CVE-2026-56260 — Crawl4AI - Arbitrary File Write via output_path Parameter (CVSS 9.1)
• CVE-2026-56259 — Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution (CVSS 8.2)
• CVE-2026-56261 — Crawl4AI - Server-Side Request Forgery via Webhook URLs (CVSS 7.5)
• CVE-2026-57573 — Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint (CVSS 8.6)
• CVE-2026-57572 — Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args (CVSS 10.0)
• CVE-2026-57571 — Crawl4AI arbitrary file write via download filename path traversal (CVSS 9.6)
• CVE-2026-56264 — Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint (CVSS 6.1)
• CVE-2026-56262 — Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server (CVSS 6.5)
• CVE-2026-53755 — Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check (CVSS 7.5)
• CVE-2026-53754 — Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) (CVSS 7.5)