id: PYSEC-2026-2140
published: "2026-07-06T21:16:58.197Z"
modified: "2026-07-13T05:48:23.723846Z"
aliases:
- CVE-2026-57573
- GHSA-wm69-2pc3-rmmf
details: Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0.
affected:
- package:
    name: crawl4ai
    ecosystem: PyPI
    purl: pkg:pypi/crawl4ai
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.9.0
  versions:
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.3.4
  - 0.3.5
  - 0.3.6
  - 0.3.7
  - 0.3.71
  - 0.3.72
  - 0.3.73
  - 0.3.731
  - 0.3.74
  - 0.3.741
  - 0.3.742
  - 0.3.743
  - 0.3.744
  - 0.3.745
  - 0.3.746
  - 0.3.8
  - 0.4.0
  - 0.4.1
  - 0.4.21
  - 0.4.22
  - 0.4.23
  - 0.4.24
  - 0.4.241
  - 0.4.242
  - 0.4.243
  - 0.4.244
  - 0.4.245
  - 0.4.246
  - 0.4.247
  - 0.4.248
  - 0.4.248b3
  - 0.4.3b1
  - 0.4.3b2
  - 0.4.3b3
  - 0.5.0
  - 0.5.0.post1
  - 0.5.0.post2
  - 0.5.0.post3
  - 0.5.0.post4
  - 0.5.0.post5
  - 0.5.0.post6
  - 0.5.0.post7
  - 0.5.0.post8
  - 0.6.0
  - 0.6.0rc1
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.7.7
  - 0.7.8
  - 0.8.0
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - 0.8.8
  - 0.8.9
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/unclecode/crawl4ai/security/advisories/GHSA-wm69-2pc3-rmmf
- type: FIX
  url: https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N