Unclecode Crawl4ai vulnerabilities

• unclecode crawl4ai Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check CVE-2026-119122 6.9 MediumOctober 29, 2026
• unclecode crawl4ai Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for CVE-2026-119121 5.3 MediumOctober 29, 2026
• unclecode crawl4ai Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name CVE-2026-119120 7.7 HighOctober 29, 2026
• unclecode crawl4ai Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields CVE-2026-119119 8.7 HighOctober 29, 2026
• unclecode crawl4ai Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags CVE-2026-119118 8.3 HighOctober 29, 2026
• unclecode crawl4ai Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields CVE-2026-115508 7.1 HighOctober 22, 2026
• unclecode crawl4ai Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo CVE-2026-112363 6.9 MediumOctober 19, 2026
• unclecode crawl4ai Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch CVE-2026-109239 6.9 MediumOctober 12, 2026
• unclecode crawl4ai Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder CVE-2026-109238 9.2 CriticalOctober 12, 2026
• unclecode crawl4ai Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables CVE-2026-109237 8.6 HighOctober 12, 2026
• unclecode crawl4ai crawl4ai before 0.9.3 DOM-based XSS via Playground UI CVE-2026-91944 5.1 MediumSeptember 15, 2026
• unclecode crawl4ai Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy CVE-2026-91943 8.3 HighSeptember 15, 2026
• unclecode crawl4ai crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML CVE-2026-91942 5.1 MediumSeptember 15, 2026
• unclecode crawl4ai Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy CVE-2026-91941 8.7 HighSeptember 15, 2026
• unclecode crawl4ai crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy CVE-2026-91940 Public exploit 8.7 HighSeptember 15, 2026
• kidocode crawl4ai Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint CVE-2026-57573 Fix available 8.6 HighJune 18, 2026
• kidocode crawl4ai Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args CVE-2026-57572 Fix available 10.0 CriticalJune 18, 2026
• kidocode crawl4ai Crawl4AI arbitrary file write via download filename path traversal CVE-2026-57571 Fix available 9.6 CriticalJune 18, 2026
• kidocode crawl4ai Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check CVE-2026-53755 Fix available 8.6 HighJune 16, 2026
• crawl4ai Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU CVE-2026-56258 Fix available 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution CVE-2026-56259 Fix available 8.8 HighJune 16, 2026
• kidocode crawl4ai Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) CVE-2026-53754 Fix available 7.5 HighJune 16, 2026
• crawl4ai Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints CVE-2026-56266 Fix available 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key CVE-2026-56265 Fix available 9.3 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint CVE-2026-56264 Fix available 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard CVE-2026-56263 Fix available 5.3 MediumJune 16, 2026
• crawl4ai Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server CVE-2026-56262 Fix available 6.9 MediumJune 16, 2026
• crawl4ai Crawl4AI - Server-Side Request Forgery via Webhook URLs CVE-2026-56261 Fix available 9.2 CriticalJune 16, 2026
• crawl4ai Crawl4AI - Arbitrary File Write via output_path Parameter CVE-2026-56260 Fix available 8.8 HighJune 16, 2026
• kidocode crawl4ai Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API CVE-2026-53753 Public exploitFix available 9.8 CriticalJune 16, 2026
• kidocode crawl4ai Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter CVE-2026-26216 Public exploitFix available 10.0 CriticalJanuary 16, 2026
• kidocode crawl4ai Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling CVE-2026-26217 Fix available 9.2 CriticalJanuary 16, 2026