Executive brief
Crawl4AI is a tool used to crawl websites and extract data for AI applications. A security flaw in its Docker-based API allows anyone with network access to run malicious commands on the server without needing a password. This could lead to a total takeover of the server, theft of sensitive API keys, and unauthorized access to other systems on the internal network.
Technical details
A remote code execution (RCE) vulnerability exists in the /crawl endpoint of Crawl4AI's Docker API deployment. The endpoint accepts a 'hooks' parameter containing Python code that is processed using the exec() function. While a sandbox was intended, the '__import__' builtin was explicitly allowed, enabling unauthenticated attackers to import the 'os' module and execute arbitrary system commands. This is classified as a code injection vulnerability (CWE-94). The issue is resolved in version 0.8.0 by removing '__import__' from the allowed builtins and disabling hooks by default via the CRAWL4AI_HOOKS_ENABLED environment variable.
Affected products
- unclecode Crawl4AI < 0.8.0
Timeline
- 2026-01-16: advisory: Vendor security advisory published on GitHub
- 2026-02-12: disclosed: CVE-2026-26216 published