PT-2026-110655 · Pypi · Crawl4Ai
CVE-2026-109238
·
Published
2026-10-12
·
Updated
2026-10-13
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Crawl4AI versions 0.7.0 through 0.9.3
Description
A server-side request forgery (SSRF) issue exists where API clients can access internal addresses. By enabling
link preview config on the '/crawl' endpoint, an attacker can provide a controlled page with include external and include patterns set. This causes the AsyncUrlSeeder() function to fetch internal, private, and cloud-metadata links and return their parsed head data.Recommendations
Update Crawl4AI to version 0.9.4 or later.
As a temporary mitigation, avoid enabling
link preview config on '/crawl' requests.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Crawl4Ai