CVE-2026-91943
High
Description
Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.
SeverityHigh
CVSS7.7
Exploit probability—
ProductUnclecode Crawl4ai
PublishedSep 15, 2026
First seenSep 15, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- unclecode crawl4ai0.9.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| unclecode crawl4ai | v < 0.9.3 | 0.9.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.