Kidocode Crawl4ai
18 CVEs affecting Kidocode Crawl4ai. Latest disclosed: 2026-07-12. Critical: 7, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57572 | Critical | 10.0 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, whi… |
CVE-2026-26216 | Critical | 10.0 | 2026-02-12 | Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter cont… |
CVE-2026-53753 | Critical | 9.8 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST… |
CVE-2026-56265 | Critical | 9.8 | 2026-06-21 | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know t… |
CVE-2026-57571 | Critical | 9.6 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken f… |
CVE-2026-56260 | Critical | 9.1 | 2026-07-12 | Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accep… |
CVE-2025-28197 | Critical | 9.1 | 2025-04-18 | Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. |
CVE-2026-56261 | High | 8.6 | 2026-07-10 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept we… |
CVE-2026-57573 | High | 8.6 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming… |
CVE-2026-53755 | High | 8.6 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL… |
CVE-2026-56266 | High | 8.6 | 2026-06-22 | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supp… |
CVE-2026-26217 | High | 8.6 | 2026-02-12 | Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpo… |
CVE-2026-56259 | High | 8.2 | 2026-07-12 | Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-cont… |
CVE-2026-56264 | High | 8.1 | 2026-06-30 | Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbi… |
CVE-2026-56258 | High | 8.1 | 2026-06-23 | Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files o… |
CVE-2026-53754 | High | 7.5 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_des… |
CVE-2026-56262 | Medium | 6.5 | 2026-06-24 | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructi… |
CVE-2026-56263 | Medium | 6.1 | 2026-06-23 | Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML wi… |