https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T16:00:23.439415+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-26217 CVE-2026-26217 — Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling 2026-10-04T16:00:23.441189+00:00

Affected: unclecode Crawl4AI

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.

 https://cve.radiocsirt.org/vuln/ghsa-vx9w-5cx4-9796 GHSA-vx9w-5cx4-9796 — Crawl4AI Has Local File Inclusion in Docker API via file:// URLs 2026-10-04T16:00:23.441244+00:00

Affected: PyPI: Crawl4AI

A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem.

Attack Vector: ```json POST /execute_js { "url": "file:///etc/passwd", "scripts": ["document.body.innerText"] } ``` Impact

An unauthenticated attacker can: - Read sensitive files (/etc/passwd, /etc/shadow, application configs) - Access environment variables via /proc/self/environ - Discover internal application structure - Potentially read credentials and API keys

Workarounds

1. Disable the Docker API 2. Add authentication to the API 3. Use network-level filtering