Medium
5.3
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API...
CVE-2026-119121
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| unclecode | crawl4ai |
≥ 0.9.0, < 0.9.5 |
0.9.5 |
Original description The description as published by the source.
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for, bypassing the js_code block to alter page state and returned crawl content.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com