VendorsKidocodecrawl4aiall versions
Vulnerabilities

Kidocode Crawl4AI

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

18CVEs
CVE-2026-53753
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Published 2026-06-23 · Analyzed
10.0EPSS 0.029
CVE-2026-26216
Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
Published 2026-02-12 · Analyzed
10.0EPSS 0.017
CVE-2026-57572
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
Published 2026-07-06 · Analyzed
10.0EPSS 0.009
CVE-2026-56265
Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
Published 2026-06-21 · Analyzed
9.8EPSS 0.026
CVE-2026-57571
Crawl4AI arbitrary file write via download filename path traversal
Published 2026-07-06 · Analyzed
9.6EPSS 0.008
CVE-2026-26217
Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling
Published 2026-02-12 · Analyzed
9.2EPSS 0.020
CVE-2026-56258
Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU
Published 2026-06-23 · Analyzed
9.2EPSS 0.009
CVE-2026-56261
Crawl4AI - Server-Side Request Forgery via Webhook URLs
Published 2026-07-10 · Analyzed
9.2EPSS 0.005
CVE-2026-56264
Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint
Published 2026-06-30 · Analyzed
9.2EPSS 0.005
CVE-2026-56266
Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
Published 2026-06-22 · Analyzed
9.2EPSS 0.005
CVE-2026-56260
Crawl4AI - Arbitrary File Write via output_path Parameter
Published 2026-07-12 · Analyzed
9.1EPSS 0.006
CVE-2025-28197
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.
Published 2025-04-18 · Analyzed
9.1EPSS 0.004
CVE-2026-56259
Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution
Published 2026-07-12 · Analyzed
8.8EPSS 0.004
CVE-2026-53755
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
Published 2026-06-23 · Analyzed
8.6EPSS 0.016
CVE-2026-57573
Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint
Published 2026-07-06 · Analyzed
8.6EPSS 0.004
CVE-2026-53754
Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)
Published 2026-06-23 · Analyzed
7.5EPSS 0.004
CVE-2026-56262
Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server
Published 2026-06-24 · Analyzed
6.9EPSS 0.008
CVE-2026-56263
Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard
Published 2026-06-23 · Analyzed
6.1EPSS 0.003