CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-53755

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default. /crawl, /crawl/stream, and /crawl/job accept a browser_config (and crawler_config). The following all feed Chromium's egress and were unchecked: browser_config.proxy_config.server, browser_config.proxy (deprecated field), crawler_config.proxy_config.server, and --proxy-server / --proxy-pac-url / --proxy-bypass-list / --host-resolver-rules flags in browser_config.extra_args. This vulnerability is fixed in 0.8.9.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 20.6%

CVSS Severity

CVSS v3 Score 8.6

References

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-6qhc-x826-342c

Products affected by CVE-2026-53755

Kidocode » Crawl4ai » Version: 0.1.0

cpe:2.3:a:kidocode:crawl4ai:0.1.0
Kidocode » Crawl4ai » Version: 0.2.0

cpe:2.3:a:kidocode:crawl4ai:0.2.0
Kidocode » Crawl4ai » Version: 0.2.1

cpe:2.3:a:kidocode:crawl4ai:0.2.1
Kidocode » Crawl4ai » Version: 0.2.2

cpe:2.3:a:kidocode:crawl4ai:0.2.2
Kidocode » Crawl4ai » Version: 0.2.4

cpe:2.3:a:kidocode:crawl4ai:0.2.4
Kidocode » Crawl4ai » Version: 0.2.6

cpe:2.3:a:kidocode:crawl4ai:0.2.6
Kidocode » Crawl4ai » Version: 0.2.7

cpe:2.3:a:kidocode:crawl4ai:0.2.7
Kidocode » Crawl4ai » Version: 0.2.71

cpe:2.3:a:kidocode:crawl4ai:0.2.71
Kidocode » Crawl4ai » Version: 0.2.72

cpe:2.3:a:kidocode:crawl4ai:0.2.72
Kidocode » Crawl4ai » Version: 0.2.73

cpe:2.3:a:kidocode:crawl4ai:0.2.73
Kidocode » Crawl4ai » Version: 0.2.74

cpe:2.3:a:kidocode:crawl4ai:0.2.74
Kidocode » Crawl4ai » Version: 0.2.77

cpe:2.3:a:kidocode:crawl4ai:0.2.77
Kidocode » Crawl4ai » Version: 0.3.0

cpe:2.3:a:kidocode:crawl4ai:0.3.0
Kidocode » Crawl4ai » Version: 0.3.3

cpe:2.3:a:kidocode:crawl4ai:0.3.3
Kidocode » Crawl4ai » Version: 0.3.6

cpe:2.3:a:kidocode:crawl4ai:0.3.6
Kidocode » Crawl4ai » Version: 0.3.745

cpe:2.3:a:kidocode:crawl4ai:0.3.745
Kidocode » Crawl4ai » Version: 0.3.746

cpe:2.3:a:kidocode:crawl4ai:0.3.746
Kidocode » Crawl4ai » Version: 0.4.24

cpe:2.3:a:kidocode:crawl4ai:0.4.24
Kidocode » Crawl4ai » Version: 0.4.243

cpe:2.3:a:kidocode:crawl4ai:0.4.243
Kidocode » Crawl4ai » Version: 0.4.247

cpe:2.3:a:kidocode:crawl4ai:0.4.247
Kidocode » Crawl4ai » Version: 0.5.0

cpe:2.3:a:kidocode:crawl4ai:0.5.0
Kidocode » Crawl4ai » Version: 0.6.0

cpe:2.3:a:kidocode:crawl4ai:0.6.0
Kidocode » Crawl4ai » Version: 0.6.3

cpe:2.3:a:kidocode:crawl4ai:0.6.3
Kidocode » Crawl4ai » Version: 0.7.0

cpe:2.3:a:kidocode:crawl4ai:0.7.0
Kidocode » Crawl4ai » Version: 0.7.1

cpe:2.3:a:kidocode:crawl4ai:0.7.1
Kidocode » Crawl4ai » Version: 0.7.2

cpe:2.3:a:kidocode:crawl4ai:0.7.2
Kidocode » Crawl4ai » Version: 0.7.3

cpe:2.3:a:kidocode:crawl4ai:0.7.3
Kidocode » Crawl4ai » Version: 0.7.4

cpe:2.3:a:kidocode:crawl4ai:0.7.4
Kidocode » Crawl4ai » Version: 0.7.5

cpe:2.3:a:kidocode:crawl4ai:0.7.5
Kidocode » Crawl4ai » Version: 0.7.6

cpe:2.3:a:kidocode:crawl4ai:0.7.6
Kidocode » Crawl4ai » Version: 0.7.7

cpe:2.3:a:kidocode:crawl4ai:0.7.7
Kidocode » Crawl4ai » Version: 0.7.8

cpe:2.3:a:kidocode:crawl4ai:0.7.8
Kidocode » Crawl4ai » Version: 0.8.0

cpe:2.3:a:kidocode:crawl4ai:0.8.0
Kidocode » Crawl4ai » Version: 0.8.5

cpe:2.3:a:kidocode:crawl4ai:0.8.5
Kidocode » Crawl4ai » Version: 0.8.6

cpe:2.3:a:kidocode:crawl4ai:0.8.6
Kidocode » Crawl4ai » Version: 0.8.7

cpe:2.3:a:kidocode:crawl4ai:0.8.7
Kidocode » Crawl4ai » Version: 0.8.8

cpe:2.3:a:kidocode:crawl4ai:0.8.8

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-53755

Products

Pricing

Contact Us