PT-2026-132352
CVE-2026-119121
·
تاريخ النشر
2026-10-29
·
تاريخ التحديث
2026-10-29
الوصف من
CVSS 3.1
4.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css selector and wait for fields. Attackers can inject quotes into css selector or supply js: conditions in wait for, bypassing the js code block to alter page state and returned crawl content.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾