{"uuid": "31b27a44-ebfe-48b5-8b54-92278bafb65b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-365w-hqf6-vxfg", "type": "seen", "source": "https://gist.github.com/alon710/e1deec66b2e7d16cb3f78258fba2c87d", "content": "# GHSA-365W-HQF6-VXFG: GHSA-365w-hqf6-vxfg: Multiple Critical Vulnerabilities in Crawl4AI Docker API Server\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-06-16\n> **Full Report:** https://cvereports.com/reports/GHSA-365W-HQF6-VXFG\n\n## Summary\nThe Crawl4AI Docker API server, in versions 0.8.6 and prior, contains multiple critical vulnerabilities including improper path sanitization, missing authentication on administration routes, hardcoded JWT secrets, and SSRF. These vulnerabilities allow remote, unauthenticated attackers to write arbitrary files, execute arbitrary code, and pivot into private cloud environments.\n\n## TL;DR\nMultiple critical security vulnerabilities in Crawl4AI versions <= 0.8.6 allow unauthenticated arbitrary file write, SSRF, dynamic code execution, and authentication bypass.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-798, CWE-22, CWE-918, CWE-94, CWE-306, CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Impact**: Arbitrary File Write, SSRF, Remote Code Execution\n\n## Affected Systems\n\n- Crawl4AI Docker API Server <= 0.8.6\n- **crawl4ai**: <= 0.8.6 (Fixed in: `0.8.7`)\n\n## Mitigation\n\n- Upgrade to version 0.8.7 or higher immediately\n- Enforce the CRAWL4AI_API_TOKEN environment variable\n- Restrict network exposure of port 8000 using firewalls or VPNs\n- Disable dynamic execution of JavaScript unless necessary\n\n**Remediation Steps:**\n1. Pull the latest Docker image or update the pip package to version 0.8.7\n2. Configure CRAWL4AI_API_TOKEN with a strong, unique secret\n3. Define a custom JWT_SECRET_KEY in the environment if JWT auth is enabled\n4. Configure host network security groups to block external unauthenticated access to the container\n\n## References\n\n- [GitHub Security Advisory GHSA-365w-hqf6-vxfg](https://github.com/advisories/GHSA-365w-hqf6-vxfg)\n- [Crawl4AI Security Advisory](https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-365W-HQF6-VXFG) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-16T20:51:26.000000Z"}