CVE-2026-91943

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.3

Description An issue exists in the PDFContentScrapingStrategy where the get pdf path() function re-downloads targets using Python requests without performing egress validation. This allows authenticated attackers to provide URLs that redirect to internal addresses or utilize DNS rebinding—a technique used to bypass security controls by changing the IP address associated with a domain name—to access internal services. Responses from these internal services can then be exfiltrated through PDF text extraction in the crawl results.

Recommendations Update to version 0.9.3 or later.