PT-2026-132352

CVE-2026-119121

·

Published

2026-10-29

·

Updated

2026-10-29

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css selector and wait for fields. Attackers can inject quotes into css selector or supply js: conditions in wait for, bypassing the js code block to alter page state and returned crawl content.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')
Related identifiers
CVE-2026-119121
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com