Executive brief
Crawl4AI is an open-source tool used to crawl and scrape websites for use with Large Language Models (LLMs). A critical security flaw in its Docker API server allows an unauthenticated attacker to execute arbitrary commands on the underlying system. This could lead to a total compromise of the server, including the theft of sensitive data, access to environment secrets, and the ability to use the infrastructure for further attacks.
Technical details
The vulnerability is an argument injection flaw (CWE-88) in the Docker API server's handling of the 'browser_config.extra_args' field. Because the API is unauthenticated by default, a remote attacker can send a crafted request to endpoints like /crawl or /crawl/stream containing malicious Chromium switches (such as --utility-cmd-prefix or --renderer-cmd-prefix) combined with --no-zygote. This causes the underlying Chromium process to execute attacker-controlled commands as the container's runtime user. While version 0.8.9 attempted to mitigate this with a denylist, it was incomplete; version 0.9.0 fixes the issue by establishing a proper trust boundary and rejecting requests that attempt to use these sensitive configuration fields.
Affected products
- unclecode crawl4ai < 0.9.0
Timeline
- 2026-06-18: patched: Version 0.9.0 released to address the RCE.
- 2026-07-06: disclosed: CVE-2026-57572 published.