Database/AI/ML frameworks & serving
Crawl4AI: JavaScript injection via css_selector and wait_for bypasses the js_code block
Impact
Crawl4AI 0.9.0 before 0.9.5 lets an authenticated client of the Docker API server run arbitrary JavaScript in the crawled page by injecting quotes into the allowlisted css_selector field or supplying a js: condition in wait_for, defeating the control that blocks the js_code parameter. Crawl4AI is commonly deployed as a shared retrieval and ingestion service feeding RAG and agent pipelines on a GPU fleet, so an API caller restricted to "just crawl this URL" regains script execution inside the browser context and can alter page state and the content returned to downstream indexing or model input. The record scores integrity impact only, within the crawler's browser - no host escape or data confidentiality loss is claimed. The practical risk is poisoned crawl output entering a shared corpus.
Who can reach it
Any client holding valid credentials for the Crawl4AI Docker API server - network-reachable, authentication required.
What to do
Upgrade to Crawl4AI 0.9.5 and restart the API container. Until then, reject or strictly validate caller-supplied css_selector and wait_for values at the gateway, and treat crawl output as untrusted input to indexing. No node-level maintenance needed.
References
Related entries
- BentoML OpenLLM 0.6.30 (async_run_command in src/openllm/common.py): A model repository directory name flows unescapedCVE-2026-15035 · BentoML OpenLLM 0.6.30 (async_run_command in src/openllm/common.py)Medium
- RAGFlow: unvalidated base_url in set_api_key lets authenticated users make server-side requestsCVE-2026-49951 · RAGFlow (POST /v1/llm/set_api_key base_url handling)Medium
- JupyterHub: unauthenticated logins write unbounded usernames to the log, exhausting storageCVE-2026-54338 · JupyterHub form-based login authenticators (failed-login logging)Medium
- vLLM: malformed JSON to the OpenAI-compatible endpoints returns server paths and versionsCVE-2026-73555 · vLLM OpenAI-compatible API server (validation_exception_handler, sanitize_message)Medium
- vLLM: attacker-supplied structured-output regex pins a CPU core and stalls the engine pathCVE-2026-73556 · vLLM structured outputs, lm-format-enforcer backend (structured_outputs.regex)Medium
- vLLM: integer overflow in the activation CUDA kernel leaks another batched request's outputCVE-2026-73558 · vLLM CUDA activation kernels (act_and_mul_kernel, activation_kernels.cu)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.