id: PYSEC-2026-230
published: "2026-06-23T13:16:44.947Z"
modified: "2026-07-09T14:40:00Z"
aliases:
- CVE-2026-56263
- GHSA-53rg-46cm-4g2v
details: Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard that renders crawl URLs and error messages via innerHTML without escaping. An attacker can submit a crafted crawl request with malicious markup that executes in an operator's browser when viewing the dashboard.
affected:
- package:
    name: crawl4ai
    ecosystem: PyPI
    purl: pkg:pypi/crawl4ai
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.8.7
  versions:
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.3.4
  - 0.3.5
  - 0.3.6
  - 0.3.7
  - 0.3.71
  - 0.3.72
  - 0.3.73
  - 0.3.731
  - 0.3.74
  - 0.3.741
  - 0.3.742
  - 0.3.743
  - 0.3.744
  - 0.3.745
  - 0.3.746
  - 0.3.8
  - 0.4.0
  - 0.4.1
  - 0.4.21
  - 0.4.22
  - 0.4.23
  - 0.4.24
  - 0.4.241
  - 0.4.242
  - 0.4.243
  - 0.4.244
  - 0.4.245
  - 0.4.246
  - 0.4.247
  - 0.4.248
  - 0.4.248b3
  - 0.4.3b1
  - 0.4.3b2
  - 0.4.3b3
  - 0.5.0
  - 0.5.0.post1
  - 0.5.0.post2
  - 0.5.0.post3
  - 0.5.0.post4
  - 0.5.0.post5
  - 0.5.0.post6
  - 0.5.0.post7
  - 0.5.0.post8
  - 0.6.0
  - 0.6.0rc1
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.7.7
  - 0.7.8
  - 0.8.0
  - 0.8.5
  - 0.8.6
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/advisories/GHSA-53rg-46cm-4g2v
- type: ADVISORY
  url: https://www.vulncheck.com/advisories/crawl4ai-stored-cross-site-scripting-in-monitor-dashboard
- type: PACKAGE
  url: https://github.com/unclecode/crawl4ai
severity:
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X