What is the CVSS score of CVE-2026-57572?

CVE-2026-57572 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Crawl4AI are affected by CVE-2026-57572?

Crawl4AI Docker API server (versions prior to 0.9.0) contains a critical unauthenticated remote code execution vulnerability enabling arbitrary command execution with container runtime privileges.. A patch is available.

How to fix or mitigate CVE-2026-57572?

24 hours: Inventory systems running Crawl4AI prior to v0.9.0; restrict Docker API network access to trusted networks only or disable entirely if not operationally required. 7 days: Upgrade all instances to Crawl4AI 0.9.0 or later; if upgrade timeline exceeds 7 days, deploy an authentication proxy (API gateway with credential enforcement) in front of the Docker API endpoint. 30 days: Conduct post-incident forensics on affected systems for command execution artifacts; implement container runtime monitoring to detect suspicious process spawning; establish network segmentation isolating container runtime networks from untrusted zones.

Crawl4AI CVE-2026-57572

EUVD-2026-41936 CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-07-06 GitHub_M

Docker Google Code Injection Crawl4ai Unclecode

10.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Default-unauthenticated network API gives AV:N/AC:L/PR:N/UI:N with full C/I/A from RCE; I assess S:U since execution stays within the container's authority, whereas NVD scored S:C (10.0).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 06, 2026 - 22:02 EUVD

Analysis Generated

Jul 06, 2026 - 21:16 vuln.today

CVE Published

Jul 06, 2026 - 20:16 cve.org

CRITICAL 10.0

DescriptionCVE.org

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. This issue is fixed in version 0.9.0.

Articles & Coverage 2

News 5 New Docker Vulnerabilities - 1 Critical, 4 High, 1 With POC Jul 07, 2026 News Critical RCE in Crawl4AI Docker API Server - CVE-2026-57572 Jul 06, 2026

AnalysisAI

Remote code execution in Crawl4AI's Docker API server (versions prior to 0.9.0) lets unauthenticated attackers run arbitrary commands as the container runtime user. The server passes request-supplied browser_config.extra_args directly into Chromium's launch arguments, enabling argument injection (CWE-88) of a malicious child-process launcher combined with --no-zygote. Because the Docker API is unauthenticated by default and CVSS is scored 10.0, a single crafted HTTP request achieves full container compromise; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Crawl4AI is an open-source, LLM-oriented web crawler/scraper that drives a headless Chromium instance, deployable as a Docker API service. The root cause is CWE-88 (argument/switch injection): the API trusts client-controlled browser_config.extra_args and forwards them verbatim to Chromium's command line. Chromium supports switches such as --renderer-cmd-prefix / launcher-override behavior that dictate how child processes are spawned; combined with --no-zygote (which disables the zygote pre-fork model and forces Chromium to fork/exec each child directly), an attacker can substitute the child-process launch command with an arbitrary binary. The affected product per CPE is cpe:2.3:a:unclecode:crawl4ai:*:*:*:*:*:*:*:* (all versions before the 0.9.0 fix).

RemediationAI

Vendor-released patch: upgrade to Crawl4AI 0.9.0, which is the authoritative fix per the GHSA advisory (https://github.com/unclecode/crawl4ai/security/advisories/GHSA-r253-r9jw-qg44) and commit 60886d1a0c52682e4c83a7cef9dfac417fff6bd2. If immediate upgrade is not possible, do not expose the Docker API server to untrusted networks: bind it to localhost or place it behind an authenticating reverse proxy and network ACLs, since the API is unauthenticated by default - the trade-off is loss of remote programmatic access. As a defense-in-depth measure until patched, reject or strip client-supplied browser_config.extra_args at a proxy layer and run the container as a minimally privileged, non-root user with a read-only filesystem and dropped capabilities to limit the blast radius of any injected command; note this reduces but does not eliminate command execution within the container.