What’s Vulnerable › Vulnerabilities

CVE-2026-91944: crawl4ai before 0.9.3 DOM-based XSS via Playground UI

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-17
• Weakness: CWE-79

Description

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like the page title to steal the operator's API token from sessionStorage and gain full server control.

Affected products

• unclecode crawl4ai: before 0.9.3 — fixed in 0.9.3

How to fix

Upgrade to a fixed version: unclecode crawl4ai 0.9.3. Check the vendor advisory for mitigations.

References

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-m446-hp3q-qfxp
• https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-dom-based-xss-via-playground-ui

Get alerted when CVE-2026-91944 or the next vulnerability affects your stack