CVE-2026-119121 in Crawl4AI
Summary
by MITRE • 10/29/2026
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for, bypassing the js_code block to alter page state and returned crawl content.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
Crawl4AI versions prior to 0.9.5 contain a critical JavaScript injection vulnerability within its Docker API server component that poses significant risks to application integrity and data confidentiality. This flaw specifically affects authenticated API clients who interact with the crawling engine through defined endpoints. The vulnerability stems from insufficient sanitization of user-supplied input fields, namely css_selector and wait_for, which are intended for controlling page interaction logic but lack proper validation against code injection patterns. Because these parameters influence how the underlying headless browser processes web pages, an attacker can manipulate them to execute arbitrary JavaScript within the context of the crawled website or the application itself.
The technical mechanism of this exploitation involves bypassing existing security controls designed to restrict script execution. The software typically employs a js_code block as a controlled method for injecting scripts into crawl pages. However, by carefully crafting input strings that include escaped quotes in the css_selector field or utilizing specific syntax such as js: conditions within the wait_for parameter, an attacker can circumvent these restrictions. This allows the injection of malicious JavaScript code directly into the page execution environment without triggering standard validation checks. The result is the ability to alter the state of the web page being crawled and modify the content returned by the API, effectively turning a data extraction tool into a vector for client-side attacks or server-side logic manipulation depending on how the output is processed downstream.
From an operational perspective, this vulnerability enables several severe impacts including cross-site scripting if the injected code affects end-users viewing crawl results, session hijacking through cookie theft, and potential remote code execution if the crawled content feeds into other systems with trust assumptions. The ability to alter page state means that automated workflows relying on accurate data extraction can be corrupted, leading to incorrect business decisions or system failures. Furthermore, since authentication is required, this represents an insider threat vector where compromised credentials could lead to significant damage within trusted environments.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and falls under the MITRE ATT&CK technique T1059 Command and Scripting Interpreter for executing arbitrary code via web application interfaces. To mitigate this risk, organizations should immediately upgrade to Crawl4AI version 0.9.5 or later where these input validation flaws have been addressed. In addition to upgrading, it is recommended to implement strict allowlisting of permitted characters in css_selector fields and enforce rigorous parsing rules for wait_for conditions that reject any syntax resembling JavaScript execution commands. Network-level controls such as Web Application Firewalls should also be configured to detect patterns indicative of code injection attempts targeting these specific API endpoints until the patch is fully deployed across all instances.