CVE-2026-91943

Crawl4AI before 0.9.3 contains a server-side request forgery (CWE-918) flaw in PDFContentScrapingStrategy: the internal _get_pdf_path() helper re-downloads PDF targets with Python requests without any egress validation. An authenticated attacker who can submit crawl targets can supply a URL that redirects to, or uses DNS rebinding to resolve to, an internal address such as cloud metadata endpoints or intranet services. The fetched content's extracted text is returned in the crawl results, giving the attacker a readable exfiltration channel into internal networks. The issue affects any deployment that lets authenticated users control crawl URLs — e.g., the Docker/daemon server mode or MCP integrations built on the library — running versions prior to 0.9.3. No public PoC exists and no exploitation has been observed, though the vulnerability is rated high (CVSS 4.0: 8.3) due to high impact on both vulnerable-system and downstream-system confidentiality.

What to do: Upgrade Crawl4AI to 0.9.3 or later, where egress validation is applied to PDF fetching. Until patched, restrict outbound traffic from crawler containers via network policy or an egress allowlist that blocks RFC1918/link-local ranges and cloud metadata IPs (169.254.169.254), and disable or sandbox PDF content fetching for user-supplied URLs. Review crawl logs and results for historical responses originating from internal addresses, which would indicate probing or data exfiltration.