Crawl4AI SSRF vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-28197 · ADVISORY
• gist.github.com/AndrewDzzz/f49e79b09ce0643ee1fc2a829e8875e0 · WEB
• unclecode/crawl4ai · PACKAGE
• pypi.org/project/crawl4ai · PACKAGE
• GitHub Advisory GHSA-445m-27cf-gr3x · ADVISORY

Weitere Schwachstellen in crawl4ai

• CVE-2026-56260KRITISCH 9.1Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_p…
• CVE-2026-56259HOCH 8.2Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API cal…
• CVE-2026-57573HOCH 8.6Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on…
• CVE-2026-57572KRITISCH 10.0Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_con…
• CVE-2026-57571KRITISCH 9.6Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination f…