Vulnerabilidades de Crawl4AI
CVEs publicadas que afetam produtos de Crawl4AI: 6 registro(s), com severidade, exploração e correções.
CVE-2026-56264
Média · 6.1
CWE-94 30/06/2026
Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint
Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser's relaxed security settings, perform server-side request forgery against internal services.
CVE-2026-56262
Média · 6.5
CWE-306 24/06/2026
Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability in the monitor router endpoints that allows unauthenticated attackers to access destructive operations. Remote attackers can invoke the /monitor/actions/cleanup endpoint and manipulate monitoring state without authentication, causing service disruption.
CVE-2026-56263
Média · 6.1
CWE-79 23/06/2026
Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard
Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping. An attacker can submit a crafted crawl request with malicious markup that executes in an operator's browser when viewing the dashboard.
CVE-2026-56258
Alta · 8.1
CWE-22 23/06/2026
Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU
Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.
CVE-2026-56266
Alta · 8.6
CWE-918 22/06/2026
Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.
CVE-2026-56265
Crítica · 9.8
Exploit público CWE-798 21/06/2026
Bypass de autenticação no Crawl4AI via chave de assinatura JWT fixa no código
O Crawl4AI anterior à versão 0.8.7 contém uma vulnerabilidade de bypass de autenticação devido a uma chave de assinatura JWT padrão embutida no código (hardcoded) no servidor de API do Docker. Atacantes que conhecem a chave padrão podem forjar tokens de autenticação válidos para qualquer usuário, contornando a autenticação e ganhando acesso total às funcionalidades protegidas.