What is the CVSS score of CVE-2026-26216?

CVE-2026-26216 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-26216?

Yes, a public proof-of-concept exploit is available for CVE-2026-26216. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-26216?

Within 24 hours: Identify all systems running Crawl4AI prior to 0.8.0 and isolate them from production networks or disable the /crawl endpoint immediately. Within 7 days: Upgrade to Crawl4AI 0.8.0 or later, or implement network-level access controls restricting the /crawl endpoint to trusted internal sources only. Within 30 days: Conduct forensic analysis of affected systems for evidence of exploitation, review access logs, and validate patch deployment across all instances.

Crawl4ai CVE-2026-26216

CRITICAL

Code Injection (CWE-94)

2026-02-12 disclosure@vulncheck.com

GHSA-5882-5rx9-xgxp

RCE Python Information Disclosure Docker Code Injection Crawl4ai Kidocode

10.0

CVSS 4.0 · Vendor: vulncheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send HTTP request to /crawl endpoint
Exploit

Supply hooks parameter with Python code
Execution

Execute arbitrary code via exec() with __import__ builtin
Impact

Achieve remote code execution as server process

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Crawl4AI versions prior to 0.8.0 with /crawl endpoint accessible. The hooks parameter must accept Python code execution. No authentication required; __import__ builtin enabled in exec() allowed list permits arbitrary module imports and command execution on default deployments.
Impact	CVSS 10.0. AI crawling tool with RCE — compromise provides access to crawled data and the Docker host.
Exploit ScenarioDerived	Attacker sends crawl request with malicious Python code in hooks parameter, achieving code execution in the Docker container.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code in hooks that executes on the server. EPSS 0.28%.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:02 CVSS 10.0

RCE via Python hooks in Crawl4AI Docker deployment.

RemediationAI

Update to Crawl4AI 0.8.0. Remove hooks from API or sandbox execution.

Affected Packages

pypi crawl4ai fix: 0.8.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-94 in Crawl4AI's /crawl endpoint. The hooks parameter accepts arbitrary Python code executed during crawling.

Know when Crawl4ai gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vulncheck) PRIMARY 10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Feb 12, 2026 - 16:16 nvd

CRITICAL 10.0

DescriptionCVE.org

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.

Executive ViewAI

Why It Matters

Crawl4AI versions before 0.8.0 contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary code on affected systems. Any organization deploying this library in production faces immediate risk of complete system compromise, data theft, and lateral movement into connected infrastructure.

Business Impact: Severe

Compensating Controls

Deploy WAF rules blocking POST requests to the /crawl endpoint containing 'hooks' parameters. 2) Implement network segmentation isolating Crawl4AI instances from sensitive systems and data. 3) Disable the hooks parameter functionality entirely if not business-critical. 4) Restrict API access to authenticated, whitelisted internal IP addresses only. 5) Monitor for exploitation attempts via request logging and anomaly detection. 6) Consider disabling or removing Crawl4AI entirely until patch can be applied.

Threat Intelligence Overview

EPSS Score

0.3%

Top 49% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS GHSA POC (1)

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +50

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.