Executive brief
Crawl4AI is a tool used for web crawling and data extraction. A vulnerability in its Docker server component allows an attacker to write files to unauthorized locations on the server, which could lead to complete system takeover or code execution. Additionally, flaws in how the system handles logs and webhooks could allow attackers to forge log entries or interfere with outbound network requests.
Technical details
Crawl4AI's Docker API server is affected by three security issues. The primary vulnerability is an arbitrary file write in the `POST /screenshot` and `POST /pdf` endpoints; the `validate_output_path` function failed to resolve symlinks, allowing a Time-of-Check to Time-of-Use (TOCTOU) exploit to write files outside the `ALLOWED_OUTPUT_DIR`. Second, a CRLF injection vulnerability (CWE-117) in logging allows attackers to forge log entries by injecting control characters into URLs or error messages. Third, a webhook header injection vulnerability (CWE-93) allows attackers to inject sensitive or hop-by-hop headers into outbound requests. The API is unauthenticated by default, increasing the risk of remote exploitation. These issues are addressed in version 0.8.8 by implementing path resolution, using `O_NOFOLLOW` for file writes, and adding strict validation for logs and webhook headers.
Affected products
- unclecode crawl4ai <= 0.8.7
Timeline
- 2026-06-04: disclosed: Initial disclosure by maintainers
- 2026-06-16: advisory: GitHub Advisory published
- 2026-06-16: patched: Fix released in version 0.8.8
References
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-7cx2-g3h9-382p
- https://github.com/unclecode/crawl4ai/issues/1
- https://github.com/unclecode/crawl4ai/issues/2
- https://github.com/unclecode/crawl4ai/pull/3
- https://api.github.com/repos/unclecode/crawl4ai/security-advisories/GHSA-7cx2-g3h9-382p