These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-57573 is a Server-Side Request Forgery (SSRF) vulnerability in Crawl4AI, an open-source LLM-friendly web crawler and scraper. The vulnerability allows a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address. This issue can lead to unauthorized access to internal resources. Users sh [truncated]
CVE-2026-57572 is a critical vulnerability in Crawl4AI's Docker API server. Prior to version 0.9.0, the server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's [truncated]
CVE-2026-57571 is a critical vulnerability in Crawl4AI, an open-source LLM-friendly web crawler and scraper. The issue allows for arbitrary file writes due to a filename traversal vulnerability. Prior to version 0.9.0, the crawler saves downloaded files with filenames taken from attacker-influenced input, joined to the downloads directory without confinement. This enables an attacker to write files with c [truncated]
CVE-2026-53753 is a critical vulnerability in Crawl4AI, an open-source LLM friendly web crawler & scraper. The vulnerability exists in the _safe_eval_expression() function, which uses an AST validator that only blocks attributes starting with underscore. This allows for a complete sandbox escape, enabling an attacker to achieve arbitrary code execution. The attack requires no authentication, as JWT is dis [truncated]
A critical vulnerability was discovered in Crawl4AI versions prior to 0.8.0, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem via the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, potentially exposing sensitive files, credentials, API keys, and internal application structure. Organizations should prioritize p [truncated]
CVE-2026-26216 is a critical remote code execution vulnerability in Crawl4AI versions prior to 0.8.0. The vulnerability exists in the Docker API deployment and is accessible through the /crawl endpoint, which accepts a hooks parameter containing Python code executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modu [truncated]