PT-2025-17342 · Crawl4Ai · Crawl4Ai

Andrewdzzz · Published 2025-04-18 · Updated 2025-06-23 · CVE-2025-28197

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.4.247 and earlier

Description The issue concerns a Server-Side Request Forgery (SSRF) vulnerability. It is located in the /crawl4ai/async dispatcher.py file.

Recommendations For versions 0.4.247 and earlier, update to a version later than 0.4.247 to resolve the issue.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-28197

GHSA-445M-27CF-GR3X

Affected Products

Crawl4Ai

References · 10

• https://osv.dev/vulnerability/GHSA-445m-27cf-gr3x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-28197 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28197 · Vendor Advisory
• https://github.com/unclecode/crawl4ai · Note
• https://twitter.com/CVEnew/status/1913455462109814812 · Twitter Post
• https://t.me/cvetracker/21957 · Telegram Post
• https://twitter.com/dailycve/status/1937273909386039580 · Twitter Post
• https://gist.github.com/AndrewDzzz/f49e79b09ce0643ee1fc2a829e8875e0 · Note
• https://t.me/cvedetector/23345 · Telegram Post
• https://twitter.com/CVETracker/status/1913684209920626977 · Twitter Post