PT-2026-56004 · Unclecode · Crawl4Ai

Seankohjs · Publicado 2026-07-06 · Atualizado 2026-07-06 · CVE-2026-57573

NVD

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle stream crawl request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler config.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-57573

Produtos afetados

Crawl4Ai

Referências · 3

• https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2 · Nota
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-wm69-2pc3-rmmf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57573 · Nota de Segurança