medium5.4
CVE-2026-91942
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.inner…
Impact
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.
Affected products
| Product | Affected versions |
|---|---|
| Crawl4ai | before 0.9.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.