Executive brief
crawl4ai is a web scraping tool whose Docker Playground UI allows operators to view crawl results interactively. A vulnerability in the Playground displays untrusted crawl output (such as text from PDFs) as HTML without sanitization, allowing an attacker to inject malicious JavaScript. An attacker who controls a target website or PDF can execute code in the Playground, stealing the operator's API authentication token and hijacking their API access.
Technical details
The vulnerability is a DOM-based XSS (CWE-79) arising from two combined issues. First, the Playground UI's forceHighlightElement() function reads text from DOM elements and assigns it to element.innerHTML, re-parsing it as HTML rather than treating it as plain text. Second, the PDF text extraction pipeline in crawl4ai/processors/pdf/utils.py wraps paragraph text in <p> tags without HTML-escaping, allowing malicious markup to pass through unescaped. An attacker can craft a malicious PDF containing event-handler elements (e.g., <img onerror=...>) that execute JavaScript when an operator views the result in the Playground. The injected script runs in the Playground origin and can read the API token from sessionStorage, enabling authenticated API abuse. Interaction is required: the operator must view the malicious crawl result. Patches are available in version 0.9.3 and later.
Affected products
- unclecode crawl4ai before 0.9.3
Timeline
- 2026-08-31: disclosed: GHSA-7g3g-vhm6-79f3 published on GitHub
- 2026-09-15: advisory: CVE-2026-91942 published on NVD
- 2026-08-31: patched: Patched in version 0.9.3