CVE-2026-91943CWE-918ssrf

CVE-2026-91943

High · published September 15, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-15T20:17Z
References (3)
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-q5rj-45vw-vp2g · [email protected]https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-ssrf-via-pdfcontentscrapingstrategy · [email protected]https://github.com/unclecode/crawl4ai/security/advisories/GHSA-q5rj-45vw-vp2g · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:18Z
    Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy
    cvelistv5