These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-91941 is a high-severity vulnerability in Crawl4AI before version 0.9.3, allowing untrusted clients to cause denial of service through the PDFContentScrapingStrategy. Attackers can exploit this by selecting the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, leading to exhaustion of disk, CPU, and bandwidth on shared workers.
CVE-2026-57573 is a Server-Side Request Forgery (SSRF) vulnerability in Crawl4AI, an open-source LLM-friendly web crawler and scraper. The vulnerability allows a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address. This issue can lead to unauthorized access to internal resources. Users sh [truncated]
CVE-2026-57572 is a critical vulnerability in Crawl4AI's Docker API server. Prior to version 0.9.0, the server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's [truncated]
CVE-2026-57571 is a critical vulnerability in Crawl4AI, an open-source LLM-friendly web crawler and scraper. The issue allows for arbitrary file writes due to a filename traversal vulnerability. Prior to version 0.9.0, the crawler saves downloaded files with filenames taken from attacker-influenced input, joined to the downloads directory without confinement. This enables an attacker to write files with c [truncated]
CVE-2026-53753 is a critical vulnerability in Crawl4AI, an open-source LLM friendly web crawler & scraper. The vulnerability exists in the _safe_eval_expression() function, which uses an AST validator that only blocks attributes starting with underscore. This allows for a complete sandbox escape, enabling an attacker to achieve arbitrary code execution. The attack requires no authentication, as JWT is dis [truncated]
A critical vulnerability was discovered in Crawl4AI versions prior to 0.8.0, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem via the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, potentially exposing sensitive files, credentials, API keys, and internal application structure. Organizations should prioritize p [truncated]
CVE-2026-26216 is a critical remote code execution vulnerability in Crawl4AI versions prior to 0.8.0. The vulnerability exists in the Docker API deployment and is accessible through the /crawl endpoint, which accepts a hooks parameter containing Python code executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modu [truncated]