Skip to main content

Crawl4ai EUVDEUVD-2026-78800

| CVE-2026-91943 HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-09-15 VulnCheck GHSA-92qr-m259-5rqq
Python SSRF Crawl4ai Unclecode
8.3
CVSS 4.0 · Vendor: VulnCheck
View

Vulnerability Assessment

Weakness
CWE
CWE-918
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Credential Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Server-side request forgery in Crawl4AI before 0.9.3 lets an authenticated user of the crawling service force the server to fetch arbitrary internal URLs through the PDF scraping path. The PDFContentScrapingStrategy helper _get_pdf_path() re-downloads the target with the Python requests library without applying the crawler's egress validation, so an attacker-supplied URL that redirects to an internal address — or that relies on DNS rebinding — is fetched and its contents returned in the crawl result after PDF text extraction. CVSS 4.0 scoring is 8.3 (AV:N/AC:L/PR:L/UI:N, VC:H/SC:H), no CISA KEV listing or public exploit code was identified at time of analysis, and the fix is available in 0.9.3.

Affected VersionsENISA

Crawl4AI 0 <0.9.3

Affected Packages

euvd crawl4ai fix: 0.9.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Crawl4ai gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
High
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Sep 15, 2026 - 16:03 EUVD
CVE Published
Sep 15, 2026 - 15:18 cve.org
HIGH 8.3

DescriptionCVE.org

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.

Articles & Coverage 1

News We need answer only title. Need format "N New [Product] Vulnerabilities - X Critical, Y With POC" but severity has critical 1 high 4. Example says X Critical maybe for critical count. User provided Severity {'CRITICAL':1,'HIGH':4}. POC count 2. Need concise article title max 100 chars. Format: "5 New Python Vulnerabilities - 1 Critical, 2 With POC". Return ONLY title no quotes. Need ensure maybe include high? Format says X Critical. Could be "1 Critical, 4 High, Sep 15, 2026

Technical POC Analysis

Evidence note: the supplied material is the GitHub advisory GHSA-q5rj-45vw-vp2g.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Threat Intelligence Overview

EPSS Score
0.3%
Top 76% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

More in Crawl4ai

View all
CVE-2026-26216 CRITICAL POC
10.0 Feb 12

Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code i
CVE-2026-56265 CRITICAL POC
9.3 Jun 21

Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
CVE-2026-26217 CRITICAL POC
9.2 Feb 12

Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers r
CVE-2026-57572 CRITICAL
10.0 Jul 06

Remote code execution in Crawl4AI's Docker API server (versions prior to 0.9.0) lets unauthenticated attackers run arbit
CVE-2026-57571 CRITICAL
9.6 Jul 06

Arbitrary file write in Crawl4AI (the open-source LLM-friendly web crawler by unclecode) before version 0.9.0 lets a mal
CVE-2026-56258 CRITICAL
9.2 Jun 23

Arbitrary file write in Crawl4AI Docker API server before 0.8.8 lets unauthenticated remote attackers escape the ALLOWED
CVE-2026-56264 CRITICAL
9.2 Jun 30

Arbitrary JavaScript execution in Crawl4AI's Docker API server (versions before 0.8.7) lets remote attackers submit code
CVE-2026-56261 CRITICAL
9.2 Jul 10

Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attack
CVE-2026-109238 CRITICAL
9.2 Oct 12

Server-side request forgery in Crawl4AI (unclecode) versions 0.7.0 through 0.9.3 lets unauthenticated, remote API client
CVE-2026-56266 CRITICAL
9.2 Jun 22

Server-side request forgery in Crawl4AI before 0.8.7 allows unauthenticated remote attackers to coerce the server into f
CVE-2025-28197 CRITICAL
9.1 Apr 18

Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. Rated critical severity (CVSS 9.1), this vuln
CVE-2026-56260 HIGH
8.8 Jul 12

Arbitrary file write in Crawl4AI's Docker API server (versions before 0.8.7) lets remote unauthenticated attackers overw

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5

References

Advisories & patches
ADVISORY https://github.com/unclecode/crawl4ai/security/advisories/GHSA-q5rj-45vw-vp2g ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-91943 REF https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-ssrf-via-pdfcontentscrapingstrategy

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy