Kidocode Crawl4ai vulnerabilities

• kidocode crawl4ai Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint CVE-2026-57573 Fix available 8.6 HighJune 18, 2026
• kidocode crawl4ai Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args CVE-2026-57572 Fix available 10.0 CriticalJune 18, 2026
• kidocode crawl4ai Crawl4AI arbitrary file write via download filename path traversal CVE-2026-57571 Fix available 9.6 CriticalJune 18, 2026
• kidocode crawl4ai Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check CVE-2026-53755 Fix available 8.6 HighJune 16, 2026
• crawl4ai Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU CVE-2026-56258 Fix available 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution CVE-2026-56259 Fix available 8.8 HighJune 16, 2026
• kidocode crawl4ai Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) CVE-2026-53754 Fix available 7.5 HighJune 16, 2026
• crawl4ai Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints CVE-2026-56266 Fix available 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key CVE-2026-56265 Fix available 9.3 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint CVE-2026-56264 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard CVE-2026-56263 5.3 MediumJune 16, 2026
• crawl4ai Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server CVE-2026-56262 6.9 MediumJune 16, 2026
• crawl4ai Crawl4AI - Server-Side Request Forgery via Webhook URLs CVE-2026-56261 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Arbitrary File Write via output_path Parameter CVE-2026-56260 8.8 HighJune 16, 2026
• kidocode crawl4ai Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API CVE-2026-53753 Public exploitFix available 9.8 CriticalJune 16, 2026
• kidocode crawl4ai Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter CVE-2026-26216 Public exploitFix available 10.0 CriticalJanuary 16, 2026
• kidocode crawl4ai Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling CVE-2026-26217 Fix available 9.2 CriticalJanuary 16, 2026
• kidocode crawl4ai Crawl4AI SSRF vulnerability CVE-2025-28197 9.1 CriticalApril 18, 2025