critical vulnerability

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Fix availableCritical · CVSS 9.2EPSS 0.48%

Published Jun 16, 2026 · updated Sep 23, 2026

What to do

Upgrade to a fixed version: crawl4ai 0.8.7.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIcrawl4ai316,023 downloads/week

Vulnerable versions: <= 0.8.6
Fixed in: 0.8.7

Check your project: pip show crawl4ai

Sources

GitHub Advisory GHSA-365w-hqf6-vxfg
NVD CVE-2026-56266

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') · CWE-94 Improper Control of Generation of Code ('Code Injection') · CWE-306 Missing Authentication for Critical Function · CWE-798 Use of Hard-coded Credentials · CWE-918 Server-Side Request Forgery (SSRF)

← All critical vulnerabilities