Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-91942

crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

unclecode crawl4ai

Default version status: unaffected

  • 0 to < 0.9.3affected
  • 0.9.3unaffected
pkg:pypi/crawl4ai

References