Beschreibung
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.
CVSS 8.6EPSS 0.47600000000000003%Risiko 0.9
Quelle öffnen- Veröffentlicht
- 2026-06-22 22:16:50
- Betroffene Versionen
- <0.8.7
- Typ
- Webanwendung
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N