Is CVE-2026-56263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56263 being exploited in the wild.

How severe is CVE-2026-56263?

Medium severity, with a CVSS score of 6.1, published 23 June 2026.

Is there a fix for CVE-2026-56263?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56263 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-56263?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56263: Crawl4AI stored XSS in monitor dashboard

CVE-2026-56263 · Severity: medium · CVSS 6.1 · Published 2026-06-23

Crawl4AI, an open-source web crawling tool used for AI data extraction, contains a security flaw in its monitoring dashboard. An attacker can submit a malicious web address that, when viewed by a system administrator or operator, executes unauthorized code in their web browser. This could allow an attacker to perform actions on behalf of the administrator or steal sensitive session information.

Quick answers

Is CVE-2026-56263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56263 being exploited in the wild.
How severe is CVE-2026-56263?: Medium severity, with a CVSS score of 6.1, published 23 June 2026.
Which products and versions are affected?: Crawl4AI Crawl4AI < 0.8.7.
Is there a fix for CVE-2026-56263?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56263 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-56263?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Crawl4AI monitor dashboard. The application uses the 'innerHTML' property to render crawl URLs and error messages without performing proper output encoding or escaping. An attacker can exploit this by submitting a crafted crawl request containing malicious HTML or JavaScript markup. When an operator views the monitoring dashboard, the payload executes in the context of their browser session. This vulnerability is fixed in version 0.8.7 by implementing server-side escaping and client-side sanitization wrappers.

Affected products

Crawl4AI Crawl4AI < 0.8.7

Timeline

2026-06-02: advisory: Vendor security advisory published (GHSA-365w-hqf6-vxfg)
2026-06-23: disclosed: CVE-2026-56263 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.