{"cve":"CVE-2026-26216","nvd":{"published":"2026-02-12T16:16:17.447","modified":"2026-10-08T16:17:11.920","status":"Analyzed","description":"Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":10.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10.0},"cwes":["CWE-94"],"references":["https://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md","https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5882-5rx9-xgxp","https://www.vulncheck.com/advisories/crawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameter"],"products":["kidocode:crawl4ai"],"source":"nvd","synced_at":"2026-10-19T22:23:35.260773158+00:00"},"epss":{"cve":"CVE-2026-26216","score":0.06418,"percentile":0.93649,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-5882-5rx9-xgxp","url":"https://osv.dev/vulnerability/GHSA-5882-5rx9-xgxp","summary":"Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter","modified":"2026-06-05T16:30:07.832816032Z","packages":[{"ecosystem":"PyPI","name":"crawl4ai","purl":"pkg:pypi/crawl4ai","ranges":["<0.8.0"],"fixed":["0.8.0"]}]},{"id":"PYSEC-2026-33","url":"https://osv.dev/vulnerability/PYSEC-2026-33","summary":"","modified":"2026-05-20T09:18:55.751893Z","packages":[{"ecosystem":"PyPI","name":"crawl4ai","purl":"pkg:pypi/crawl4ai","ranges":["<0.8.0"],"fixed":["0.8.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}