EUVD-2026-38433
GHSA-53rg-46cm-4g2v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no-auth crawl submission stores payload; scope changes to operator browser on dashboard load; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping. An attacker can submit a crafted crawl request with malicious markup that executes in an operator's browser when viewing the dashboard.
AnalysisAI
Stored XSS in Crawl4AI's monitor dashboard (versions before 0.8.7) enables an unauthenticated remote attacker to inject persistent malicious markup by submitting a crafted crawl URL or triggering a crafted error message; the payload executes in any operator's browser that subsequently views the dashboard. This flaw is one of six vulnerabilities disclosed together in GHSA-365w-hqf6-vxfg, and its impact is materially amplified in unpatched deployments by a co-disclosed authentication bypass (CWE-306) that left all monitor endpoints, including the dashboard, accessible without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Crawl4AI (cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:*) is an open-source Python-based web-crawling framework distributed via pip and typically deployed as a Docker API server. The monitor dashboard is a browser-rendered UI that displays crawl job metadata - including the submitted URL and any associated error messages - by injecting these values directly into the DOM via innerHTML without HTML-escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: attacker-controlled string data flows from the crawl submission endpoint into persistent server-side storage and is later reflected into DOM-manipulation calls without sanitization. The GHSA advisory confirms the dual fix required: server-side html.escape() applied at storage time, and a client-side escapeHtml() wrapper applied at every innerHTML template injection site.
RemediationAI
Upgrade to Crawl4AI 0.8.7 or later via pip install --upgrade crawl4ai; this is the vendor-released patch confirmed by both the GHSA advisory and pip package metadata. Version 0.8.7 applies server-side html.escape() to URL and error message data before storage, and wraps all client-side innerHTML template injections with an escapeHtml() sanitization function. As a compensating control prior to patching, restrict network access to the Docker API server so only trusted operators can reach it - this limits the attacker's ability to submit crafted crawl requests and also mitigates several co-disclosed vulnerabilities (SSRF, arbitrary file write). Disabling or firewall-blocking the monitor dashboard endpoint entirely prevents the XSS rendering surface while leaving core crawl functionality intact, though this prevents legitimate monitoring use. Full advisory details are at https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg and VulnCheck advisory at https://www.vulncheck.com/advisories/crawl4ai-stored-cross-site-scripting-in-monitor-dashboard.
Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers r
Remote code execution in Crawl4AI's Docker API server (versions prior to 0.9.0) lets unauthenticated attackers run arbit
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code i
Arbitrary file write in Crawl4AI (the open-source LLM-friendly web crawler by unclecode) before version 0.9.0 lets a mal
Arbitrary file write in Crawl4AI Docker API server before 0.8.8 lets unauthenticated remote attackers escape the ALLOWED
Arbitrary JavaScript execution in Crawl4AI's Docker API server (versions before 0.8.7) lets remote attackers submit code
Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attack
Server-side request forgery in Crawl4AI before 0.8.7 allows unauthenticated remote attackers to coerce the server into f
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. Rated critical severity (CVSS 9.1), this vuln
Arbitrary file write in Crawl4AI's Docker API server (versions before 0.8.7) lets remote unauthenticated attackers overw
Credential exfiltration in Crawl4AI's Docker API server (all versions before 0.8.8) lets remote unauthenticated attacker
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today