CVE-2026-91942 — crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers ca…
Published: 2026-09-15 · CVSS: 5.1 · CVSS 4.0
crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7