Kidocode

Crawl4ai

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2026-56262

  • EPSS 0.42%
  • Veröffentlicht 24.06.2026 11:53:13
  • Zuletzt bearbeitet 26.06.2026 02:00:03

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipu...

6.1

CVE-2026-56263

  • EPSS 0.19%
  • Veröffentlicht 23.06.2026 12:13:00
  • Zuletzt bearbeitet 25.06.2026 18:39:04

Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping. An attacker can submit a crafted crawl request with malicious markup that e...

9.2

CVE-2026-56258

  • EPSS 0.66%
  • Veröffentlicht 23.06.2026 12:12:59
  • Zuletzt bearbeitet 25.06.2026 18:38:53

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on...

9.8

CVE-2026-56265

  • EPSS 0.43%
  • Veröffentlicht 21.06.2026 13:26:54
  • Zuletzt bearbeitet 26.06.2026 13:52:16

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication...

7.5

CVE-2026-26217

  • EPSS 0.61%
  • Veröffentlicht 12.02.2026 15:33:27
  • Zuletzt bearbeitet 20.02.2026 16:54:08

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files...

10

CVE-2026-26216

  • EPSS 1.59%
  • Veröffentlicht 12.02.2026 15:31:20
  • Zuletzt bearbeitet 20.02.2026 16:52:49

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in th...

9.1

CVE-2025-28197

  • EPSS 0.3%
  • Veröffentlicht 18.04.2025 00:00:00
  • Zuletzt bearbeitet 23.06.2025 19:49:56

Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.