# unclecode crawl4ai.

Every CVE that names unclecode crawl4ai among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check](https://agentprime.io/advisories/CVE-2026-119122.md)
  `CVE-2026-119122` · CVE record: unclecode crawl4ai · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for](https://agentprime.io/advisories/CVE-2026-119121.md)
  `CVE-2026-119121` · CVE record: unclecode crawl4ai · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name](https://agentprime.io/advisories/CVE-2026-119120.md)
  `CVE-2026-119120` · CVE record: unclecode crawl4ai · CVSS 7.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields](https://agentprime.io/advisories/CVE-2026-119119.md)
  `CVE-2026-119119` · CVE record: unclecode crawl4ai · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service
- [Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags](https://agentprime.io/advisories/CVE-2026-119118.md)
  `CVE-2026-119118` · CVE record: unclecode crawl4ai · CVSS 8.3 High · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS
- [Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields](https://agentprime.io/advisories/CVE-2026-115508.md)
  `CVE-2026-115508` · CVE record: unclecode crawl4ai · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Denial of service
- [Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo](https://agentprime.io/advisories/CVE-2026-112363.md)
  `CVE-2026-112363` · CVE record: unclecode crawl4ai · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch](https://agentprime.io/advisories/CVE-2026-109239.md)
  `CVE-2026-109239` · CVE record: unclecode crawl4ai · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder](https://agentprime.io/advisories/CVE-2026-109238.md)
  `CVE-2026-109238` · CVE record: unclecode crawl4ai · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables](https://agentprime.io/advisories/CVE-2026-109237.md)
  `CVE-2026-109237` · CVE record: unclecode crawl4ai · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Insecure deserialization
- [crawl4ai before 0.9.3 DOM-based XSS via Playground UI](https://agentprime.io/advisories/CVE-2026-91944.md)
  `CVE-2026-91944` · CVE record: unclecode crawl4ai · CVSS 5.1 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy](https://agentprime.io/advisories/CVE-2026-91943.md)
  `CVE-2026-91943` · CVE record: unclecode crawl4ai · CVSS 8.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML](https://agentprime.io/advisories/CVE-2026-91942.md)
  `CVE-2026-91942` · CVE record: unclecode crawl4ai · CVSS 5.1 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy](https://agentprime.io/advisories/CVE-2026-91941.md)
  `CVE-2026-91941` · CVE record: unclecode crawl4ai · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Denial of service
- [crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy](https://agentprime.io/advisories/CVE-2026-91940.md)
  `CVE-2026-91940` · CVE record: unclecode crawl4ai · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=unclecode-crawl4ai>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/unclecode-crawl4ai/>. Everything for agents: <https://agentprime.io/llms.txt>.