This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-109237 | BDVDB-2026-386283 Detail

unclecodecrawl4ai

Description#

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-502 Deserialization of Untrusted Data

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.