Crawl4AI is an open-source crawler used to turn web pages into content for language-model workflows. CVE-2026-119121 affects the Docker API server in versions 0.9.0 through 0.9.4. An authenticated API client can run arbitrary JavaScript in the crawl page through the allowlisted css_selector and wait_for fields.
The crawler already accepts JavaScript-related options, so the vulnerability is not simply that the product can execute code in a browser. The problem is that fields intended to select elements or control waiting were passed into a JavaScript evaluation path without sufficient separation from untrusted request data.
The issue is fixed in 0.9.5. The public advisory assigns a medium score, but the impact depends on what the crawler can reach and what sessions or network access its browser has.
The browser is the execution context
An API token protects the crawler endpoint. It does not make every API field safe. A user who can submit a crawl configuration is already trusted to make the crawler fetch URLs. The new boundary is page-context JavaScript execution inside the browser that processes those URLs.
That context can interact with the current page, read its rendered data and make requests allowed by the browser's network position. It may reach internal services if the crawler runs inside a private network. It can also interfere with the results returned to the caller.
The advisory does not establish host-level code execution or access to every browser profile. Keep the conclusion at page-context JavaScript and the authority available to the crawler process.
Who can reach the API
Inventory Docker API deployments, tokens, reverse proxies and networks. A crawler endpoint that requires a token is still a risk when tokens are shared broadly or issued to automated jobs that accept external input.
Review whether the service has access to metadata endpoints, internal applications or privileged browser extensions. Browsers used for crawling usually need broad outbound access, which increases the value of JavaScript execution.
Upgrade and constrain
Upgrade to Crawl4AI 0.9.5 or later. Restrict the Docker API to trusted networks and use unique API tokens per consumer. Do not expose an unauthenticated crawler API directly to the internet.
Use a dedicated container and browser profile. Block access to cloud metadata and management networks unless a documented crawl requires it. Limit filesystem mounts and credentials available to the container.
After the upgrade, send a controlled request containing selector or wait input that attempts to run code and confirm that the field is treated as data. Test ordinary CSS selectors and wait conditions separately so that a rejected malicious case does not mask a broken crawl.
Investigate results and network activity
Review crawler request logs for unexpected selectors, JavaScript-like strings, unusual target URLs and outbound connections from the container. Compare crawl results with the target pages if content integrity matters.
Rotate API tokens if an untrusted client could reach the service. Review any credentials available to the browser and check for changes to stored crawl jobs or configurations.
Design lesson
Allowlists must preserve data types. A selector is not safe because it appears in a field named css_selector, and a wait condition is not safe because it is part of a crawler API. Generated JavaScript should receive untrusted values as arguments or through a constrained parser, not as source text.