PT-2026-92061 · Pypi · Crawl4Ai
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
crawl4ai versions prior to 0.9.3
Description
The Docker Playground UI contains a DOM-based cross-site scripting issue where untrusted crawl results are assigned to
element.innerHTML. This allows attackers to use malicious PDFs containing event-handler markup to execute JavaScript within the Playground origin. This execution can be used to steal API tokens from sessionStorage, leading to authenticated API abuse.Recommendations
Update crawl4ai to version 0.9.3 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Crawl4Ai