Which versions of Crawl4AI are affected by CVE-2026-56264?

Crawl4AI Docker API server (versions before 0.8.7) contains a critical vulnerability enabling remote code execution that compromises internal network security.. A patch is available.

How to fix or mitigate CVE-2026-56264?

24 hours: Identify all Crawl4AI deployments, restrict network access to the API server, and block the /execute_js endpoint via firewall or WAF; review recent logs for exploitation activity. 7 days: Implement IP whitelisting, configure network egress controls to prevent SSRF pivots to internal services, and enable monitoring for suspicious endpoint access. 30 days: Monitor vendor security advisories for patch availability and upgrade to patched version immediately upon release; conduct incident review to identify any historical exploitation.

Crawl4AI CVE-2026-56264

Q: What is the CVSS score of CVE-2026-56264?

CVE-2026-56264 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40431 CRITICAL

Code Injection (CWE-94)

2026-06-30 VulnCheck

GHSA-g2pv-76hm-j4x9

RCE Docker SSRF Code Injection Crawl4ai

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Unauthenticated network endpoint executes attacker JavaScript (PR:N), but high complexity (AC:H) reflects the dependence on an exposed Docker server and reachable internal targets; full code-execution impact gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 02:16 EUVD

Analysis Generated

Jun 30, 2026 - 23:24 vuln.today

CVE Published

Jun 30, 2026 - 22:08 cve.org

CRITICAL 9.2

DescriptionCVE.org

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser's relaxed security settings, perform server-side request forgery against internal services.

Articles & Coverage 1

News Critical Arbitrary JS Execution in Crawl4AI Docker API - CVE-2026-56264 Jul 01, 2026

AnalysisAI

Arbitrary JavaScript execution in Crawl4AI's Docker API server (versions before 0.8.7) lets remote attackers submit code to the /execute_js endpoint, which runs it inside the server's Chromium browser context launched with --disable-web-security. Because the browser's same-origin and CORS protections are disabled, attacker-controlled JavaScript can pivot into server-side request forgery against internal services and metadata endpoints. No public exploit has been identified at time of analysis, and the CVSS 4.0 base score is 9.2 (critical), though the vector's high attack complexity and present attack requirements indicate exploitation is not fully trivial.

Technical ContextAI

Crawl4AI is an open-source, LLM-oriented web crawling and scraping framework that ships an optional Docker API server exposing HTTP endpoints. The /execute_js endpoint is designed to run user-supplied JavaScript inside a headless browser (Playwright/Chromium) to render and manipulate pages. The root cause maps to CWE-94 (Improper Control of Generation of Code / Code Injection): the server treats request input as executable code with no sandboxing of the action. The danger is amplified by the browser being launched with --disable-web-security, which removes same-origin policy and CORS enforcement, so injected JavaScript can issue cross-origin fetches to internal hosts the server can reach. The single affected component is identified by cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:* across all versions prior to 0.8.7.

RemediationAI

Upgrade to Crawl4AI 0.8.7 or later, the vendor-released patched version, as the primary fix (see advisory https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg). If immediate patching is not possible, do not expose the Docker API server to untrusted networks: bind it to localhost or place it behind authentication and a reverse proxy, and restrict network access to the /execute_js endpoint via firewall rules - accepting that this disables remote use of the JS-execution feature for legitimate clients. Where feasible, run the container with egress network controls (deny outbound access to internal/metadata ranges such as 169.254.169.254 and RFC1918 hosts) to blunt the SSRF impact, noting this may break crawling of intended internal targets. Removing the --disable-web-security browser flag, if your deployment allows configuring it, restores same-origin/CORS protections and materially reduces the SSRF pivot, at the cost of breaking crawls that relied on relaxed cross-origin behavior.