The Docker API server of Crawl4AI does not cap the delay_before_return_html, mean_delay and max_range fields of untrusted crawl requests. A network client that can reach the API can send very large values to /crawl or /crawl/stream, which keeps browser pages busy and stalls the rate limiter. This exhausts the page pool and blocks other crawls, which is a service outage risk without data loss. The default configuration is affected because JWT authentication is disabled by default.
unclecode · Crawl4AI
Crawl4AI launches Chromium with --ignore-certificate-errors, so the browser accepts any TLS certificate, and the hard-coded --no-sandbox flag overrides the sandbox setting. A network attacker who can intercept traffic or control DNS for a crawled host can serve forged content to the crawler and read cookies and headers that the crawl sends. The crawled content can then feed downstream systems such as RAG or LLM pipelines. The attack requires a man-in-the-middle or DNS-control position on the crawler's network path.
unclecode · Crawl4AI
Crawl4AI versions 0.7.0 to 0.9.3 contain a server-side request forgery (SSRF) flaw in the link preview feature of the URL seeder. An API client that can reach /crawl can enable link preview and supply a page it controls, so the server fetches internal, private, link-local and cloud-metadata addresses. According to the vendor, the parsed head content of these responses is returned to the caller, and no authentication is required when the API is deployed unauthenticated, which is the default.
unclecode · Crawl4AI
Crawl4AI from 0.9.0 before 0.9.4 contains a flaw in its untrusted-config gate of the Docker API server. A non-admin API client can wrap forbidden config objects in dict wrappers, which lets an LLMConfig resolve environment references such as api_token="env:NAME" and return server environment variables via /config/dump. Leaked values can include provider API keys and SECRET_KEY, which may allow forging an admin JWT.
unclecode · Crawl4AI
