CVE-2026-119121

CVSS 5.3 (medium) · published 2026-10-29

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for, bypassing the js_code block to alter page state and returned crawl content.

Weakness: CWE-95

Source: NVD CVE-2026-119121

References

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qj46-wp7m-rgj8
• https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-javascript-injection-via-css-selector-and-wait-for

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.