CVE-2026-57572: Crawl4AI Web Crawler Allows Unauthorized Command Execution

Summary

The Crawl4AI web crawler, used for scraping and crawling, had a security issue prior to version 0.9.0. An attacker could exploit this issue to run malicious code on the system, potentially leading to unauthorized access or data breaches. To fix this issue, update to version 0.9.0 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
unclecode	crawl4ai	< 0.9.0
kidocode	crawl4ai	< 0.9.0 `cpe:2.3:a:kidocode:crawl4ai::::::::`

Original title

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch argum...

Original description

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. This issue is fixed in version 0.9.0.

nvd CVSS3.1 10.0

Vulnerability type

CWE-88

CWE-94 Code Injection