CVE-2026-91943
Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.
| CWE | CWE-918 |
| Vendor | unclecode |
| Product | crawl4ai |
| Published | Sep 15, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for unclecode crawl4ai
Be the first to know when new high vulnerabilities affecting unclecode crawl4ai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
unclecode / crawl4ai
0 < 0.9.3
References
Credits
🔍 c240030