CVE-2026-26217

Summary

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can acces

Severity

high

EPSS

0.6% (p43)

Also known as

GHSA-vx9w-5cx4-9796, PYSEC-2026-34

Published

2026-02-12

References

• https://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-vx9w-5cx4-9796
• https://www.vulncheck.com/advisories/crawl4ai-docker-api-local-file-inclusion-via-file-url-handling

Related advisories

• GHSA-r253-r9jw-qg44 — critical · PyPI/crawl4ai
• GHSA-2jq4-q6vv-4cp3 — critical · PyPI/crawl4ai
• GHSA-365w-hqf6-vxfg — critical · PyPI/crawl4ai
• CVE-2026-53753 — critical · PyPI/crawl4ai
• CVE-2026-26216 — critical · PyPI/crawl4ai
• GHSA-wm69-2pc3-rmmf — high · PyPI/crawl4ai
• CVE-2026-53755 — high · PyPI/crawl4ai
• GHSA-7cx2-g3h9-382p — high · PyPI/crawl4ai

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity