NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍 PyPI
Not in CISA KEV

CVE-2026-26216 — crawl4ai

CVE-2026-26216 is a Code Injection vulnerability in crawl4ai. A fix is available for crawl4ai — see the affected versions and patch details below.

Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter

Also known asGHSA-5882-5rx9-xgxpPYSEC-2026-33
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-26216.

EPSS Exploitation Probability

via FIRST.org ↗
6.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs94th percentile — riskier than 94% of all scored CVEsHighest risk
0.00%2.77%5.54%8.31%0.3%6.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐍crawl4ai

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

A critical remote code execution vulnerability exists in the Crawl4AI Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing attackers to import arbitrary modules and execute system commands.

Attack Vector:

POST /crawl
{
  "urls": ["https://example.com"],
  "hooks": {
    "code": {
      "on_page_context_created": "async def hook(page, context, **kwargs):\n    __import__('os').system('malicious_command')\n    return page"
    }
  }
}

Impact

An unauthenticated attacker can:

  • Execute arbitrary system commands
  • Read/write files on the server
  • Exfiltrate sensitive data (environment variables, API keys)
  • Pivot to internal network services
  • Completely compromise the server

Mitigation

  1. Upgrade to v0.8.0 (recommended)
  2. If unable to upgrade immediately:
    • Disable the Docker API
    • Block /crawl endpoint at network level
    • Add authentication to the API

Fix Details

  1. Removed __import__ from allowed_builtins in hook_manager.py
  2. Hooks disabled by default (CRAWL4AI_HOOKS_ENABLED=false)
  3. Users must explicitly opt-in to enable hooks

Credits

Discovered by Neo by ProjectDiscovery (https://projectdiscovery.io)

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIcrawl4aiall versions0.8.0pip install --upgrade 'crawl4ai==0.8.0'

Affected Products

1 product · 1 configurations
Application
crawl4aikidocode
< 0.8.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for crawl4ai, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update crawl4ai to 0.8.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-26216 is resolved across your whole dependency graph.

  3. Workarounds

    Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.

How to detect CVE-2026-26216

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2026-26216 -u https://target
Template
Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter
Severity
critical
Impact
An unauthenticated attacker can achieve full server compromise: arbitrary command execution, file read/write, exfiltration of environment variables and API keys, and lateral movement into internal networks.
Remediation
Upgrade to Crawl4AI 0.8.0 or later, which removes __import__ from allowed_builtins in hook_manager.py and disables hooks by default (CRAWL4AI_HOOKS_ENABLED=false). As an interim mitigation, disable the Docker API deployment or restrict network access to it and add authentication.

Template by ProjectDiscovery nuclei-templates (dishantmodi), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

A critical remote code execution vulnerability exists in the Crawl4AI Docker API deployment. The `/crawl` endpoint accepts a `hooks` parameter containing Python code that is executed using `exec()`. The `__import__` builtin was included in the allowed builtins, allowing attackers to import arbitrary modules and execute system commands. **Attack Vector:** ```json POST /crawl { "urls": ["https://example.com"], "hooks": { "code": { "on_page_context_created": "async def hook(page, context, **kwargs):\n __import__('os').system('malicious_command')\n return page" } } } ```
O3 Security · Impact-Aware SCA

Is CVE-2026-26216 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-26216: crawl4ai RCE — Fixed in 0.8.0