Descrição
Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.
CVSS 8.6EPSS 0.47600000000000003%Risco 0.9
Ver fonte- Publicação
- 2026-06-22 22:16:50
- Versões afetadas
- <0.8.7
- Tipo
- Aplicação web
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N