CyberRota Analysis
AI-GeneratedCrawl4ai versions prior to 0.9.3 are susceptible to a DOM-based cross-site scripting vulnerability in the Playground UI, allowing attackers to inject malicious scripts via crawled page content. This can lead to the theft of the operator's API token from sessionStorage, potentially granting full control over the server. Organizations utilizing affected versions should prioritize patching to mitigate the risk of unauthorized access and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like the page title to steal the operator's API token from sessionStorage and gain full server control.