CVE-2026-91944

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91944
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91944.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91944
Aliases
  • GHSA-m446-hp3q-qfxp
Published
2026-09-15T15:18:03Z
Modified
2026-09-18T03:30:57Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
crawl4ai before 0.9.3 DOM-based XSS via Playground UI
Details

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like the page title to steal the operator's API token from sessionStorage and gain full server control.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91944.json"
}
References

Affected packages

Git / github.com/unclecode/crawl4ai

Affected ranges

Type
GIT
Repo
https://github.com/unclecode/crawl4ai
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4bcd5fa8a56000ce103dd499e8ecdff2439f3e9c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.3.4
docker-rebuild-v0.*
docker-rebuild-v0.8.6
docker-rebuild-v0.8.7
docker-rebuild-v0.8.8
docker-rebuild-v0.8.9
docker-rebuild-v0.9.0
docker-rebuild-v0.9.1
docker-rebuild-v0.9.2
v.*
v.3.72
v0.*
v0.0.75
v0.1.0
v0.2.0
v0.2.1
v0.2.4
v0.2.6
v0.2.7
v0.2.71
v0.2.72
v0.2.73
v0.2.74
v0.2.77
v0.3.0
v0.3.3
v0.3.6
v0.3.745
v0.4.24
v0.4.243
v0.5.0.post1
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.2
vr0.*
vr0.6.0
vr0.6.0rc1
vr0.6.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91944.json"