Is crawl4ai affected by CVE-2026-26216?

PyPI crawl4ai is affected in <0.8.0.

Is CVE-2026-26216 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 1.0%.

critical

CVE-2026-26216

Q: Is CVE-2026-26216 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 1.0%.

PyPI · crawl4ai

Summary

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remot

Severity: critical
EPSS: 1.0% (p59)
Also known as: GHSA-5882-5rx9-xgxp, PYSEC-2026-33
Published: 2026-02-12

References

Related advisories

GHSA-r253-r9jw-qg44 — critical · PyPI/crawl4ai
GHSA-2jq4-q6vv-4cp3 — critical · PyPI/crawl4ai
GHSA-365w-hqf6-vxfg — critical · PyPI/crawl4ai
CVE-2026-53753 — critical · PyPI/crawl4ai
GHSA-wm69-2pc3-rmmf — high · PyPI/crawl4ai
CVE-2026-53755 — high · PyPI/crawl4ai
GHSA-7cx2-g3h9-382p — high · PyPI/crawl4ai
GHSA-f989-c77f-r2cq — high · PyPI/crawl4ai

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.