CVE-2026-119118

CVSS 8.3 (high) · published 2026-10-29

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.

Weakness: CWE-295

Source: NVD CVE-2026-119118

References

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q
• https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-improper-certificate-validation-via-hard-coded-chromium-flags
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.