# crawl4ai (PyPI) vulnerabilities 18 known vulnerabilities (11 critical, 5 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.9.5 (Oct 14, 2026): no advisory affects it - Newest unaffected release: 0.9.5 (Oct 14, 2026), the latest release - Weekly downloads: 358.1K - Dependents: 152 - Releases: 73 since 0.3.0 (Sep 25, 2024) - Registry: https://pypi.org/project/crawl4ai/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-56260: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-56259: 0.3.0 to 0.8.7 (0.8.8 is outside it) - CVE-2026-56261: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-57572: 0.3.0 to 0.8.9 (0.9.0 is outside it) - CVE-2026-57573: 0.3.0 to 0.8.9 (0.9.0 is outside it) - CVE-2026-57571: 0.3.0 to 0.8.9 (0.9.0 is outside it) - CVE-2026-56264: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-56262: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-53753: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-53754: 0.3.0 to 0.8.7 (0.8.8 is outside it) - CVE-2026-53755: 0.3.0 to 0.8.8 (0.8.9 is outside it) - CVE-2026-56263: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-56258: 0.3.0 to 0.8.7 (0.8.8 is outside it) - CVE-2026-56266: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-56265: 0.3.0 to 0.8.6 (0.8.7 is outside it) - CVE-2026-26217: 0.3.0 to 0.7.8 (0.8.0 is outside it) - CVE-2026-26216: 0.3.0 to 0.7.8 (0.8.0 is outside it) - CVE-2025-28197: 0.3.0 to 0.4.247 (0.4.248b3 is outside it) ## Advisories (18) ### [CVE-2026-56260](https://cve.now/CVE-2026-56260): Crawl4AI - Arbitrary File Write via output\_path Parameter - Severity: High 8.8 - Published: Jul 12, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 41 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56259](https://cve.now/CVE-2026-56259): Crawl4AI - LLM Credential Exfiltration via base\_url and Environment Variable Resolution - Severity: High 8.8 - Published: Jul 12, 2026 - Affected: fixed in 0.8.8. - Fixed in 0.8.8 (released Jun 4, 2026, 38 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56261](https://cve.now/CVE-2026-56261): Crawl4AI - Server-Side Request Forgery via Webhook URLs - Severity: Critical 9.2 - Published: Jul 10, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 39 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-57572](https://cve.now/CVE-2026-57572): Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser\_config.extra\_args - Severity: Critical 10.0 - Published: Jul 6, 2026 - Affected: fixed in 0.9.0. - Fixed in 0.9.0 (released Jun 18, 2026, 18 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-57573](https://cve.now/CVE-2026-57573): Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint - Severity: High 8.6 - Published: Jul 6, 2026 - Affected: fixed in 0.9.0. - Fixed in 0.9.0 (released Jun 18, 2026, 18 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-57571](https://cve.now/CVE-2026-57571): Crawl4AI arbitrary file write via download filename path traversal - Severity: Critical 9.6 - Published: Jul 6, 2026 - Affected: fixed in 0.9.0. - Fixed in 0.9.0 (released Jun 18, 2026, 18 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56264](https://cve.now/CVE-2026-56264): Crawl4AI - Arbitrary JavaScript Execution via /execute\_js Endpoint - Severity: Critical 9.2 - Published: Jun 30, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 29 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56262](https://cve.now/CVE-2026-56262): Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server - Severity: Medium 6.9 - Published: Jun 24, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 23 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-53753](https://cve.now/CVE-2026-53753): Crawl4AI: AST Sandbox Escape via gi\_frame.f\_back Chain - Pre-Auth RCE in Docker API - Severity: Critical 9.8 - Published: Jun 23, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 22 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-53754](https://cve.now/CVE-2026-53754): Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) - Severity: High 7.5 - Published: Jun 23, 2026 - Affected: fixed in 0.8.8. - Fixed in 0.8.8 (released Jun 4, 2026, 19 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-53755](https://cve.now/CVE-2026-53755): Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check - Severity: High 8.6 - Published: Jun 23, 2026 - Affected: fixed in 0.8.9. - Fixed in 0.8.9 (released Jun 4, 2026, 19 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56263](https://cve.now/CVE-2026-56263): Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 22 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56258](https://cve.now/CVE-2026-56258): Crawl4AI - Arbitrary File Write via output\_path Symlink and TOCTOU - Severity: Critical 9.2 - Published: Jun 23, 2026 - Affected: fixed in 0.8.8. - Fixed in 0.8.8 (released Jun 4, 2026, 19 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56266](https://cve.now/CVE-2026-56266): Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints - Severity: Critical 9.2 - Published: Jun 22, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 21 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-56265](https://cve.now/CVE-2026-56265): Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key - Severity: Critical 9.3 - Published: Jun 21, 2026 - Affected: fixed in 0.8.7. - Fixed in 0.8.7 (released Jun 1, 2026, 20 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-26217](https://cve.now/CVE-2026-26217): Crawl4AI \< 0.8.0 Docker API Local File Inclusion via file URL Handling - Severity: Critical 9.2 - Published: Feb 12, 2026 - Affected: fixed in 0.8.0. - Fixed in 0.8.0 (released Jan 16, 2026, 27 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2026-26216](https://cve.now/CVE-2026-26216): Crawl4AI \< 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter - Severity: Critical 10.0 - Published: Feb 12, 2026 - Affected: fixed in 0.8.0. - Fixed in 0.8.0 (released Jan 16, 2026, 27 days before disclosure). - The latest release, 0.9.5, is not affected. ### [CVE-2025-28197](https://cve.now/CVE-2025-28197): Crawl4AI \<=0.4.247 is vulnerable to SSRF in /crawl4ai/async\_dispatcher.py. - Severity: Critical 9.1 - Published: Apr 18, 2025 - Affected: through 0.4.247. - Fixed in 0.4.248 (released Feb 1, 2025, 76 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.9.5, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/crawl4ai Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.