Description
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| unclecode | crawl4ai | < 0.9.3 | 0.9.3 |
References
- GitHub Security Advisory (GHSA-7g3g-vhm6-79f3) vendor-advisory
- VulnCheck Advisory: crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML third-party-advisory