crawl4ai vulnerabilities (PyPI)
18 vulnerabilities.
-
crawl4aiPyPI Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint 8.6 High -
crawl4aiPyPI Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args 10.0 Critical -
crawl4aiPyPI Crawl4AI arbitrary file write via download filename path traversal 9.6 Critical -
crawl4aiPyPI Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check 8.6 High -
crawl4aiPyPI Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU 9.2 Critical -
crawl4aiPyPI Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution 8.8 High -
crawl4aiPyPI Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) 7.5 High -
crawl4aiPyPI Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints 9.2 Critical -
crawl4aiPyPI Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key 9.3 Critical -
crawl4aiPyPI Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint 9.2 Critical -
crawl4aiPyPI Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard 5.3 Medium -
crawl4aiPyPI Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server 6.9 Medium -
crawl4aiPyPI Crawl4AI - Server-Side Request Forgery via Webhook URLs 9.2 Critical -
crawl4aiPyPI Crawl4AI - Arbitrary File Write via output_path Parameter 8.8 High -
crawl4aiPyPI Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API 9.8 Critical -
crawl4aiPyPI Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter 10.0 Critical -
crawl4aiPyPI Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling 9.2 Critical -
crawl4aiPyPI Crawl4AI SSRF vulnerability 9.1 Critical