Recommended action

Update crawl4ai to 0.8.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Crawl4AI Has Local File Inclusion in Docker API via file:// URLs affects crawl4ai (pip). Severity is critical. A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem. Attack Vector: ```json POST /execute_js { "url": "file:///etc/passwd", "scripts": ["document.body.innerText"] } ``` Impact An unauthenticated attacker can: - Read sensitive files (/etc/passwd, /etc/shadow, application configs) - Access environment variables via /proc/self/environ - Discover internal application structure - Potentially read credentials and API keys Workarounds 1. Disable the Docker API 2. Add authentication to the API 3. Use network-level filtering

AI coding agents often install or upgrade packages automatically in pip. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update crawl4ai to 0.8.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Crawl4AI Has Local File Inclusion in Docker API via file:// URLs affects crawl4ai (pip). Severity is critical. A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem. Attack Vector: ```json POST /execute_js { "url": "file:///etc/passwd", "scripts": ["document.body.innerText"] } ``` Impact An unauthenticated attacker can: - Read sensitive files (/etc/passwd, /etc/shadow, application configs) - Access environment variables via /proc/self/environ - Discover internal application structure - Potentially read credentials and API keys Workarounds 1. Disable the Docker API 2. Add authentication to the API 3. Use network-level filtering

AI coding agents often install or upgrade packages automatically in pip. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software