CVE-2026-56264

HIGH

Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint

Title source: cna
STIX 2.1

Description

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser's relaxed security settings, perform server-side request forgery against internal services.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint
https://www.vulncheck.com/advisories/crawl4ai-arbitrary-javascript-execution-via-execute-js-endpoint

Scores

CVSS v3 8.1
EPSS 0.0033
EPSS Percentile 26.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (3)
Crawl4AI/Crawl4AI < 0.8.7
Crawl4AI/Crawl4AI 0.8.7
kidocode/crawl4ai < 0.8.7
Published Jun 30, 2026
Tracked Since Jul 01, 2026