Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. This issue is fixed in version 0.9.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-08 | 1 | Patch1 |
| 2026-07-09 | 1 | Patch1 |
| 2026-07-10 | 1 | Disclosure1 |
| 2026-07-15 | 1 | General1 |
| 2026-07-18 | 1 | Disclosure1 |
【緊急】CVE-2026-57572 Crawl4AI 0.9.0以前に深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/14/cve-2026-57572-crawl4ai-090/ #IT #Security #cybersecurity
Post summary
The announcement reports a critical vulnerability (CVE‑2026‑57572) in Crawl4AI versions 0.9.0 and earlier, urging users to respond immediately.
【緊急】CVE-2026-57572 Crawl4AI 0.9.0以前に深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/14/cve-2026-57572-crawl4ai-090/ #IT #Security #cybersecurity
Post summary
An urgent alert warns about CVE-2026-57572 affecting Crawl4AI versions up to 0.9.0, but no further technical or remediation details are given.
🚨 CRITICAL - Crawl4AI Chromium extra_args argument injection leads to RCE (CVE-2026-57572) Crawl4AI before 0.9.0 is vulnerable to argument injection because request-supplied browser_config.extra_args are passed directly into Chromium launch arguments. The root cause is improper input validation/argument sanitization, enabling attacker-controlled Chromium switch injection and child-process command replacement (e.g., leveraging --no-zygote). Exploitation is remote: a single crafted request can inject malicious flags, and in common deployments the Docker API server is unauthenticated by default, removing any meaningful access barrier. Successful exploitation results in arbitrary command execution as the container runtime user, enabling full container compromise, data theft, and lateral movement. 👉 Affected: crawl4ai < 0.9.0 | Upgrade to 0.9.0
Post summary
The tweet announces a critically‑serious RCE vulnerability in Crawl4AI (CVE‑2026‑57572), provides technical details, and recommends upgrading to v0.9.0 as the patch.
🕷️ CVE-2026-57572: Crawl4AI Docker API lets anyone inject Chromium launch args via browser_config.extra_args, leading to unauthenticated RCE. CVSS 10. Upgrade to 0.9.0 now. https://secalerts.co/vulnerability/CVE-2026-57572?utm_campaign=x https://t.co/MuT1x2hYOY
Post summary
The post announces CVE-2026-57572 as an unauthenticated RCE vulnerability via Chromium launch (browser_config.extra_args) and recommends upgrading to v0.9.0 to remediate it.
Warning: 2 critical vulnerabilities in #Crawl4ai. #CVE-2026-57572 (CVSS: 10) & #CVE-2026-57571 (CVSS: 9.6). These allow unauthenticated attackers to achieve command injection via the Docker API, leading to #RCE on your device. #Patch #Patch #Patch
Post summary
The tweet warns of two critical vulnerabilities (CVE‑2026‑57572 and CVE‑2026‑57571) in Crawl4ai that allow unauthenticated command injection via the Docker API, leading to remote code execution, and urges users to apply the available patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kidocode | crawl4ai | - | - | - |