Crawl4AI CVE-2026-57572

Exploitation requires network reachability to the Crawl4AI Docker API server and that the request path accepts browser_config.extra_args (the default behavior prior to 0.9.0). Because the Docker API is unauthenticated by default and the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are needed against a default deployment - the injected --no-zygote plus a child-process launch-command switch are the only crafted inputs. The key limiting factor is exposure: the target instance must be reachable by the attacker, so instances bound to localhost, restricted by firewall/ACLs, or placed behind added authentication are not exploitable by remote unauthenticated attackers.

This is a genuine top-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) aligns cleanly with the description: network-reachable, low complexity, no privileges, no user interaction, full impact. The default-unauthenticated Docker API removes the only meaningful barrier, making exploitation trivial where the service is network-exposed. No EPSS score, SSVC decision, KEV listing, or POC flag was supplied in the input, so exploitation probability and automatability cannot be quantified from the data - however, the primitive (single unauthenticated request to RCE) is inherently automatable, so absence of an EPSS/KEV signal reflects missing data rather than low real risk. The main risk-limiting factor is exposure: instances bound only to localhost or behind authentication/network controls are not reachable by remote attackers.

An attacker scans for internet-exposed Crawl4AI Docker API endpoints and sends a single crafted crawl request whose browser_config.extra_args includes a child-process-launcher override plus --no-zygote pointing at an attacker-chosen command. When Crawl4AI launches Chromium with those injected switches, Chromium execs the attacker's command as the container runtime user, yielding immediate arbitrary code execution. No authentication or user interaction is required, and given AV:N/AC:L this is readily scriptable at scale.