crawl4ai
v0.9.5Official Crawl4AI Cloud: a hosted web scraping, extraction, and search API for AI agents. Free API key, 1,000 credits a month, no card. Fully open source: this repo is the Apache-2.0 crawler that powers it, and you can self-host it.
- Maintenance
- Active101 commits in 3 months · bus factor 1
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 25 advisories5 critical, 12 high, 8 medium
- Supported versions
- No scheduleendoflife.date does not track this project
87.4k stars · 9.1k forks · 349 open issues · last release 1 month ago · data checked 34 minutes ago
Security advisories
All advisories on GitHubThe 25 most recent advisories published by the maintainers: 5 critical, 12 high, 8 medium. Check the patched version against the one you run.
- mediumGHSA-j2qh-f73r-mg3qOct 15, 2026Chromium launched with --ignore-certificate-errors, so TLS verification is off on the Docker server
- Affected
- <= 0.9.4
- Patched in
- 0.9.5
- mediumGHSA-rhjm-7hj7-75fxOct 15, 2026Unbounded delay fields in untrusted CrawlerRunConfig bodies on the Docker server
- Affected
- <= 0.9.4
- Patched in
- 0.9.5
- mediumGHSA-j843-8p47-rhxpOct 15, 2026ReDoS via untrusted regex patterns freezes the Docker server
- Affected
- >= 0.9.0, <= 0.9.4
- Patched in
- 0.9.5
- highGHSA-f856-7xp9-w3ccOct 15, 2026Untrusted CosineStrategy model_name lets an API client choose the HuggingFace model the Docker server loads
- Affected
- >= 0.9.0, <= 0.9.4
- Patched in
- 0.9.5
- mediumGHSA-qj46-wp7m-rgj8Oct 15, 2026JavaScript injection in the crawl page via untrusted css_selector and wait_for on the Docker server
- Affected
- >= 0.9.0, <= 0.9.4
- Patched in
- 0.9.5
- mediumGHSA-w4xc-px5p-c32wOct 15, 2026Blind SSRF via CacheValidator freshness check bypasses the Docker server egress proxy
- Affected
- <= 0.9.4
- Patched in
- 0.9.5
- highGHSA-5w5p-vcv6-mm3fSep 23, 2026Untrusted-config gate bypass via dict-wrapper laundering leaks server env vars (LLM keys, SECRET_KEY)
- Affected
- >= 0.9.0, <= 0.9.3
- Patched in
- 0.9.4
- highGHSA-wh5w-hmj3-vgg7Sep 23, 2026SSRF with response disclosure via link_preview_config: the URL seeder fetches links outside the egress controls
- Affected
- <= 0.9.3
- Patched in
- 0.9.4
- mediumGHSA-f77g-77vp-r96vSep 23, 2026Blind SSRF via robots.txt fetch in RobotsParser.can_fetch bypasses the Docker server egress controls
- Affected
- <= 0.9.3
- Patched in
- 0.9.4
- highCVE-2026-91944Aug 31, 2026DOM-based XSS in Docker Playground UI leads to operator API-token theft
- Affected
- <= 0.9.2
- Patched in
- 0.9.3
- highGHSA-q5rj-45vw-vp2gAug 31, 2026SSRF in PDFContentScrapingStrategy: PDF download follows redirects and bypasses egress SSRF controls
- Affected
- <= 0.9.2
- Patched in
- 0.9.3
- mediumGHSA-7g3g-vhm6-79f3Aug 31, 2026XSS in Docker Playground: crawl results rendered via innerHTML; PDF pipeline emits unescaped HTML
- Affected
- <= 0.9.2
- Patched in
- 0.9.3
- mediumGHSA-v2rm-hvrj-2x9qAug 31, 2026Denial of Service in PDFContentScrapingStrategy: unbounded remote PDF size and page count
- Affected
- <= 0.9.2
- Patched in
- 0.9.3
- highGHSA-xpp7-j28w-2gvxAug 31, 2026Arbitrary file write via unconfined PDFContentScrapingStrategy fields in untrusted config bodies
- Affected
- >= 0.9.0, <=0.9.2
- Patched in
- 0.9.3
- highCVE-2026-57573Jun 18, 2026Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)
- Affected
- <= 0.8.9
- Patched in
- 0.9.0
- criticalCVE-2026-57572Jun 18, 2026Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
- Affected
- <= 0.8.9
- Patched in
- 0.9.0
- criticalCVE-2026-57571Jun 18, 2026Arbitrary file write (path traversal) in crawler downloads can lead to RCE
- Affected
- <= 0.8.9
- Patched in
- 0.9.0
- highCVE-2026-53755Jun 4, 2026SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
- Affected
- <= 0.8.8
- Patched in
- 0.8.9
- highGHSA-7cx2-g3h9-382pJun 4, 2026Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
- Affected
- <= 0.8.7
- Patched in
- 0.8.8
- highGHSA-f989-c77f-r2cqJun 4, 2026LLM credential exfiltration in Docker server via request base_url and env: token resolution
- Affected
- <= 0.8.7
- Patched in
- 0.8.8
- highCVE-2026-53754Jun 4, 2026SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)
- Affected
- <= 0.8.7
- Patched in
- 0.8.8
- criticalGHSA-365w-hqf6-vxfgJun 2, 2026Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
- Affected
- <= 0.8.6
- Patched in
- 0.8.7
- criticalCVE-2026-53753Jun 2, 2026AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
- Affected
- <= 0.8.6
- Patched in
- 0.8.7
- criticalGHSA-5882-5rx9-xgxpJan 16, 2026Remote Code Execution in Docker API via Hooks Parameter
- Affected
- < 0.8.0
- Patched in
- 0.8.0
- highGHSA-vx9w-5cx4-9796Jan 16, 2026Local File Inclusion in Docker API via file:// URLs
- Affected
- < 0.8.0
- Patched in
- 0.8.0