Skip to content
AI Sec Watch
CriticalVulnerability

GHSA-365w-hqf6-vxfg: Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-365w-hqf6-vxfg
Published
Record updated
View JSON
Affected
  • crawl4ai <= 0.8.6
Fixed in
0.8.7
  • released June 1, 2026, 15 days before disclosure

Summary

GHSA-365w-hqf6-vxfg describes multiple security vulnerabilities in the Crawl4AI Docker API server, affecting crawling, markdown/LLM extraction, screenshot, PDF, webhook, monitoring, JavaScript execution and configuration endpoints. The flaws include arbitrary file write via output_path on /screenshot and /pdf, SSRF through webhook URLs and direct crawl endpoints, an authentication bypass on monitor endpoints, stored XSS in the monitor dashboard, arbitrary JavaScript execution via /execute_js, and a hardcoded JWT secret defaulting to "mysecret".

Mitigation

Upgrade to the patched version (recommended). Other workarounds: set CRAWL4AI_API_TOKEN to enable authentication, set a strong SECRET_KEY (min 32 chars) if using JWT, and restrict network access to the Docker API. Per-issue fixes include validate_output_path() restricting writes to CRAWL4AI_OUTPUT_DIR, validate_webhook_url() blocking private and metadata addresses, token_dep on the monitor router, disabling /execute_js by default via CRAWL4AI_EXECUTE_JS_ENABLED, removing the default JWT key, and normalizing IPv6-mapped IPv4 addresses before the blocklist check.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • crawl4aiPyPILLM dependency since 2024-09-25 · 4 tracked dependents

Related items