Executive brief
Crawl4AI, an open-source web crawling tool used for AI data extraction, contains a security flaw in its monitoring dashboard. An attacker can submit a malicious web address that, when viewed by a system administrator or operator, executes unauthorized code in their web browser. This could allow an attacker to perform actions on behalf of the administrator or steal sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Crawl4AI monitor dashboard. The application uses the 'innerHTML' property to render crawl URLs and error messages without performing proper output encoding or escaping. An attacker can exploit this by submitting a crafted crawl request containing malicious HTML or JavaScript markup. When an operator views the monitoring dashboard, the payload executes in the context of their browser session. This vulnerability is fixed in version 0.8.7 by implementing server-side escaping and client-side sanitization wrappers.
Affected products
- Crawl4AI Crawl4AI < 0.8.7
Timeline
- 2026-06-02: advisory: Vendor security advisory published (GHSA-365w-hqf6-vxfg)
- 2026-06-23: disclosed: CVE-2026-56263 published to NVD