What is the CVSS score of CVE-2026-57571?

CVE-2026-57571 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Crawl4AI are affected by CVE-2026-57571?

Crawl4AI, an open-source LLM web crawler used by organizations for web data extraction, contains a critical remote code execution vulnerability affecting all versions before 0.9.0.. A patch is available.

How to fix or mitigate CVE-2026-57571?

Within 24 hours: Inventory all systems running Crawl4AI; immediately restrict crawler operations to whitelisted, trusted domains only; disable processing of untrusted sources. Within 7 days: Monitor Crawl4AI repository and unclecode announcements for version 0.9.0 release; prepare staging environment for testing. Within 30 days: Deploy Crawl4AI 0.9.0 or later to all systems and validate in staging before production rollout.

Crawl4AI CVE-2026-57571

EUVD-2026-41934 CRITICAL

Path Traversal (CWE-22)

2026-07-06 GitHub_M

RCE Path Traversal Crawl4ai Unclecode

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote attacker-controlled content with low complexity and no victim auth (PR:N) but requires the victim to crawl it (UI:R); arbitrary write outside the intended dir changes scope (S:C) and yields RCE, so C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 22:02 EUVD

Analysis Generated

Jul 06, 2026 - 21:13 vuln.today

DescriptionCVE.org

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitrary file write with attacker-controlled contents; the HTTP crawler path uses the response Content-Disposition filename and the browser crawler path uses the download's suggested filename. Because the written bytes are attacker-controlled, this can escalate to remote code execution. This issue is fixed in version 0.9.0.

AnalysisAI

Arbitrary file write in Crawl4AI (the open-source LLM-friendly web crawler by unclecode) before version 0.9.0 lets a malicious website or download control where crawled files land on disk, and because the file contents are also attacker-controlled this escalates to remote code execution. Both the HTTP crawler path (trusting the response Content-Disposition filename) and the browser crawler path (trusting the download's suggested filename) are affected. CVSS is 9.6 (Critical); no public exploit is identified at time of analysis and it is not listed in CISA KEV, but a fix commit and GHSA advisory are published.

Technical ContextAI

Crawl4AI is a Python web crawling/scraping library commonly embedded in LLM and RAG data-ingestion pipelines to fetch and store web content. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): when saving a downloaded file, the destination filename is taken from attacker-influenced input and naively joined to the configured downloads directory with no confinement check (no normalization/prefix validation against the intended base path). A filename carrying an absolute path (e.g. /etc/... or a Windows path) or ../ traversal sequences therefore resolves outside the downloads directory. The two ingestion surfaces differ in source of the tainted name - the HTTP path derives it from the server's Content-Disposition header, and the browser (headless) path from the browser's suggested download filename - but both feed the same unsafe join, so writing attacker bytes to an arbitrary location (startup scripts, cron, web roots, Python site-packages, etc.) yields code execution. Affected CPE: cpe:2.3:a:unclecode:crawl4ai:*.

RemediationAI

Vendor-released patch: upgrade to Crawl4AI 0.9.0, which fixes the unsafe filename handling (see advisory GHSA-2jq4-q6vv-4cp3 and commit 60886d1a0c52682e4c83a7cef9dfac417fff6bd2). If you cannot upgrade immediately, only crawl trusted destinations and avoid running the crawler against untrusted or attacker-influenced sites, disable file-download handling in the crawler configuration where possible, and run the crawler under a low-privilege, sandboxed/containerized account whose write scope is confined (e.g. mount the downloads directory on a dedicated volume with no execute permission and no overlap with system or application paths) so a traversal write cannot reach startup scripts, web roots, or Python package directories; note these controls reduce functionality (no downloads) or add operational overhead (sandboxing) but do not fully close the flaw the way the 0.9.0 upgrade does. Advisory: https://github.com/unclecode/crawl4ai/security/advisories/GHSA-2jq4-q6vv-4cp3.