Crawl4AI vulnerabilities
We track 6 vulnerabilities in Crawl4AI products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 12, 2026.
Latest Crawl4AI vulnerabilities
- 9.1 Critical severity
Crawl4AI: Improper Limitation of a Pathname to a Restricted Directory
Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-tra
- 8.2 High severity
Crawl4AI: Exposure of Sensitive Information to an Unauthorized Actor
Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated
- 7.5 High severity
Crawl4AI: Server-Side Request Forgery
Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or
- 8.1 High severity
Crawl4AI: Improper Limitation of a Pathname to a Restricted Directory
Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the outpu
- 8.6 High severity
Crawl4AI: Server-Side Request Forgery
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist usi
- 9.8 Critical severity
Crawl4AI: Use of Hard-coded Credentials
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaini