Description
Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping. An attacker can submit a crafted crawl request with malicious markup that executes in an operator's browser when viewing the dashboard.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Crawl4AI | Crawl4AI | < 0.8.7 | 0.8.7 |
References
- GitHub Security Advisory (GHSA-365w-hqf6-vxfg) vendor-advisory
- https://github.com/unclecode/crawl4ai product
- VulnCheck Advisory: Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard third-party-advisory