PyPIPackage

crawl4ai

18 known vulnerabilities (11 critical, 5 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 0.9.5 (Oct 14, 2026): no advisory affects it
Newest unaffected release: 0.9.5 (Oct 14, 2026), the latest release
Advisories: 18 · 11 critical, 5 high, 2 medium

Weekly downloads: 358.1K
Dependents: 152
Releases: 73 since 0.3.0 (Sep 25, 2024)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-56260
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)
CVE-2026-56259
Affects 0.3.0 to 0.8.7 (0.8.8 is outside it)
CVE-2026-56261
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)
CVE-2026-57572
Affects 0.3.0 to 0.8.9 (0.9.0 is outside it)
CVE-2026-57573
Affects 0.3.0 to 0.8.9 (0.9.0 is outside it)
CVE-2026-57571
Affects 0.3.0 to 0.8.9 (0.9.0 is outside it)
CVE-2026-56264
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)
CVE-2026-56262
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)
CVE-2026-53753
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)
CVE-2026-53754
Affects 0.3.0 to 0.8.7 (0.8.8 is outside it)
CVE-2026-53755
Affects 0.3.0 to 0.8.8 (0.8.9 is outside it)
CVE-2026-56263
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)

Show all 18 advisoriesShow fewer advisories

CVE-2026-56258
Affects 0.3.0 to 0.8.7 (0.8.8 is outside it)
CVE-2026-56266
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)
CVE-2026-56265
Affects 0.3.0 to 0.8.6 (0.8.7 is outside it)
CVE-2026-26217
Affects 0.3.0 to 0.7.8 (0.8.0 is outside it)
CVE-2026-26216
Affects 0.3.0 to 0.7.8 (0.8.0 is outside it)
CVE-2025-28197
Affects 0.3.0 to 0.4.247 (0.4.248b3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

CVE-2026-56260High 8.8
Crawl4AI - Arbitrary File Write via output_path Parameter
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 41 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56259High 8.8
Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution
Affected: fixed in 0.8.8.
Fixed in 0.8.8 (released Jun 4, 2026, 38 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56261Critical 9.2
Crawl4AI - Server-Side Request Forgery via Webhook URLs
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 39 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-57572Critical 10.0
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Jun 18, 2026, 18 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-57573High 8.6
Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Jun 18, 2026, 18 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-57571Critical 9.6
Crawl4AI arbitrary file write via download filename path traversal
Affected: fixed in 0.9.0.
Fixed in 0.9.0 (released Jun 18, 2026, 18 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56264Critical 9.2
Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 29 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56262Medium 6.9
Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 23 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-53753Critical 9.8
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-53754High 7.5
Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)
Affected: fixed in 0.8.8.
Fixed in 0.8.8 (released Jun 4, 2026, 19 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-53755High 8.6
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
Affected: fixed in 0.8.9.
Fixed in 0.8.9 (released Jun 4, 2026, 19 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56263Medium 5.3
Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 22 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56258Critical 9.2
Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU
Affected: fixed in 0.8.8.
Fixed in 0.8.8 (released Jun 4, 2026, 19 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56266Critical 9.2
Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 21 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-56265Critical 9.3
Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
Affected: fixed in 0.8.7.
Fixed in 0.8.7 (released Jun 1, 2026, 20 days before disclosure).
The latest release, 0.9.5, is not affected.

Show all 18 advisoriesShow fewer advisories

CVE-2026-26217Critical 9.2
Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling
Affected: fixed in 0.8.0.
Fixed in 0.8.0 (released Jan 16, 2026, 27 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2026-26216Critical 10.0
Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
Affected: fixed in 0.8.0.
Fixed in 0.8.0 (released Jan 16, 2026, 27 days before disclosure).
The latest release, 0.9.5, is not affected.
CVE-2025-28197Critical 9.1
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.
Affected: through 0.4.247.
Fixed in 0.4.248 (released Feb 1, 2025, 76 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.9.5, is not affected.