PT-2026-54027 · Crawl4Ai · Crawl4Ai
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Crawl4AI versions prior to 0.8.7
Description
Multiple security issues affect the Crawl4AI Docker API server:
- The
/execute jsendpoint allows arbitrary JavaScript execution in the server's browser context because--disable-web-securityis enabled, which can be used to perform server-side request forgery (SSRF) against internal services. - The
/screenshotand/pdfendpoints are susceptible to arbitrary file write via theoutput pathparameter, allowing attackers to overwrite server files or write to any appuser-writable location. - SSRF is possible through the
/crawl/joband/llm/jobendpoints via webhook URLs, as well as through the/crawl,/crawl/stream,/md, and/llmendpoints. Attackers can bypass internal-address blocklists using IPv6-mapped IPv4 addresses to access internal services and cloud metadata endpoints. - An authentication bypass exists in the monitor router, making endpoints such as
/monitor/actions/cleanupaccessible without authentication. - The monitor dashboard is vulnerable to stored cross-site scripting (XSS) because it renders crawl URLs and error messages using
innerHTMLwithout proper escaping. - The system uses a hardcoded JWT secret key defaulting to
mysecret, enabling the forgery of authentication tokens.
Recommendations
Update to version 0.8.7 or later.
Set
CRAWL4AI API TOKEN to enable authentication.
Configure a strong SECRET KEY with at least 32 characters for JWT.
Restrict network access to the Docker API.
As a temporary mitigation, disable the /execute js endpoint by setting the CRAWL4AI EXECUTE JS ENABLED environment variable to false.Exploit
Fix
SSRF
Path traversal
Missing Authentication
Using Hardcoded Credentials
Code Injection
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Crawl4Ai