CVE-2026-26216

The record

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.

Affected packages

Related vulnerabilities

• GHSA-5882-5rx9-xgxp Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter Same vulnerability
• CVE-2026-26217 Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the… Also affects crawl4ai
• GHSA-vx9w-5cx4-9796 Crawl4AI Has Local File Inclusion in Docker API via file:// URLs Also affects crawl4ai
• CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
• CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
• CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94
• CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. CWE-94
• CVE-2026-112042 A security flaw has been discovered in diem-project diem up to… CWE-94