Security Advisory

CVE-2026-91942

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-15 15:18:02

Last updated 2026-09-15 15:18:02

Assigner VulnCheck

CVSS score 5.4

State PUBLISHED

Description

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.

← Browse all CVEs View on cve.org ↗