CVE-2026-26216
CRITICAL 1 PoC
INFO
Priority: 0.63
BB Relevance:
91/100
Published: 2026-02-12
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
None
VC:
High
VI:
High
VA:
High
Description
Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.
Weakness Classification (1)
References & Advisories (3)
vendor-advisory
third-party-advisory
release-notes