C240030

**Name of the Vulnerable Software and Affected Versions** Crawl4AI versions prior to 0.9.3 **Description** An uncontrolled resource consumption issue exists in the `PDFContentScrapingStrategy` that allows untrusted clients to cause a denial of service. Attackers can trigger this by selecting the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, which exhausts disk space, CPU, and bandwidth on shared workers. **Recommendations** Update to version 0.9.3 or later. As a temporary mitigation, restrict the use of the `PDFContentScrapingStrategy` in POST requests.

**Name of the Vulnerable Software and Affected Versions** crawl4ai versions prior to 0.9.3 **Description** The Docker Playground UI contains a DOM-based cross-site scripting issue where untrusted crawl results are assigned to `element.innerHTML`. This allows attackers to use malicious PDFs containing event-handler markup to execute JavaScript within the Playground origin. This execution can be used to steal API tokens from `sessionStorage`, leading to authenticated API abuse. **Recommendations** Update crawl4ai to version 0.9.3 or later.

**Name of the Vulnerable Software and Affected Versions** Crawl4AI versions prior to 0.9.3 **Description** An issue exists in the `PDFContentScrapingStrategy` where the ` get pdf path()` function re-downloads targets using Python requests without performing egress validation. This allows authenticated attackers to provide URLs that redirect to internal addresses or utilize DNS rebinding—a technique used to bypass security controls by changing the IP address associated with a domain name—to access internal services. Responses from these internal services can then be exfiltrated through PDF text extraction in the crawl results. **Recommendations** Update to version 0.9.3 or later.