# CVE-2026-119121: Crawl4AI JavaScript injection in Docker API server

Source: https://junglewise.ai/threats/cve-2026-119121-crawl4ai-from-0-9-0-before-0-9-5-contains-a-javascript-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119121 · Severity: medium · CVSS 4.3 · Published 2026-10-29

Crawl4AI is a web crawling library that can run in a Docker container with an API server. Authenticated attackers can inject malicious JavaScript code into the crawling engine via the css_selector and wait_for parameters, allowing them to manipulate page content and alter the data returned by crawl requests. This bypasses the server's intended restrictions on untrusted JavaScript execution.

Technologies: [Unclecode Crawl4AI](https://junglewise.ai/threats/technologies/unclecode-crawl4ai). Vendors: [Unclecode](https://junglewise.ai/threats/vendors/unclecode).

## Quick answers

**Is CVE-2026-119121 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119121 being exploited in the wild.

**How severe is CVE-2026-119121?** Medium severity, with a CVSS score of 4.3, published 29 October 2026.

**Which products and versions are affected?** Unclecode Crawl4AI 0.9.0 to 0.9.4.

**Is there a fix for CVE-2026-119121?** Yes: fixed in 0.9.5. Until then: At your reverse proxy, reject crawler_config bodies where css_selector contains double quotes or where wait_for is not prefixed with css:. Additionally, issue API tokens only to trusted clients.</anigation>
<parameter name="attack_vector">["network"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119121 attacked?** It is in a software library.

**Am I affected by CVE-2026-119121?** Check whether you run Unclecode Crawl4AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.9.5

At your reverse proxy, reject crawler_config bodies where css_selector contains double quotes or where wait_for is not prefixed with css:. Additionally, issue API tokens only to trusted clients.</anigation>
<parameter name="attack_vector">["network"]

## Technical details

The vulnerability exists in AsyncPlaywrightCrawlerStrategy._crawl_web() and smart_wait() methods, which use unsafe string interpolation when processing css_selector and wait_for fields. An attacker can close the string literal in css_selector with a quote character to inject arbitrary JavaScript, or supply a js: prefixed condition in wait_for to execute JavaScript directly. Both fields are in the allowlist for untrusted requests and lack proper input validation on their content.

## Affected products

- unclecode Crawl4AI 0.9.0 to 0.9.4

## Timeline

- 2026-10-15: disclosed
- 2026-10-29: advisory

## References

- [https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qj46-wp7m-rgj8](https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qj46-wp7m-rgj8)
- [https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-javascript-injection-via-css-selector-and-wait-for](https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-javascript-injection-via-css-selector-and-wait-for)

## Related threats

- [Crawl4AI blind SSRF in CacheValidator proxy bypass](https://junglewise.ai/threats/cve-2026-119122-crawl4ai-before-0-9-5-contains-a-blind-server-side-request)
- [Crawl4AI untrusted model loading in CosineStrategy](https://junglewise.ai/threats/cve-2026-119120-crawl4ai-from-0-9-0-before-0-9-5-fails-to-filter-the)
- [Crawl4AI denial of service in Docker API server](https://junglewise.ai/threats/cve-2026-119119-crawl4ai-before-0-9-5-contains-a-denial-of-service-vulnerability)
- [Crawl4AI improper certificate validation in Chromium launch](https://junglewise.ai/threats/cve-2026-119118-crawl4ai-before-0-9-5-contains-an-improper-certificate)
- [Crawl4AI inefficient regular expression complexity in Docker API](https://junglewise.ai/threats/cve-2026-115508-crawl4ai-0-7-0-before-0-9-5-contains-an-inefficient-regular)