CVE-2026-91942: Unclecode CRAWL4AI

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.

Affected products

• Unclecode CRAWL4AI: before 0.9.3 (fixed in 0.9.3)

Published 2026-09-15. Last modified 2026-09-17.