CVE-2026-57572: Kidocode Crawl4ai RCE Vulnerability

CVE-2026-57572 Overview

CVE-2026-57572 is an argument injection vulnerability [CWE-88] in Crawl4AI, an open-source LLM-friendly web crawler and scraper. Versions prior to 0.9.0 accept a request-supplied browser_config.extra_args field on the Docker API server. Attackers can inject Chromium switches such as --no-zygote combined with a replacement child-process launch command, forcing Chromium to fork or exec an attacker-controlled binary as the container's runtime user. The Docker API server ships unauthenticated by default, so a single unauthenticated HTTP request produces arbitrary command execution inside the container.

Critical Impact
Unauthenticated attackers can achieve arbitrary command execution in Crawl4AI Docker containers with a single HTTP request, enabling full container takeover.

Affected Products

Kidocode Crawl4AI Docker API server versions prior to 0.9.0
Deployments using the default unauthenticated Docker server configuration
Container images built from C4AI_VER=0.8.9 and earlier

Discovery Timeline

2026-07-06 - CVE-2026-57572 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-57572

Vulnerability Analysis

Crawl4AI exposes an HTTP API that spawns Chromium browser instances to render and scrape pages. The Docker API server accepts a JSON body containing browser_config.extra_args, an array of command-line switches forwarded directly to Chromium at launch. The server performs no allowlist filtering on these switches.

Chromium supports a family of switches that control how child processes are launched, including --browser-subprocess-path and --renderer-cmd-prefix. When combined with --no-zygote, these switches cause the parent Chromium process to execute the attacker-specified binary as a child process instead of the normal renderer or utility process. The result is arbitrary command execution as the container's runtime user, categorized under [CWE-88] Improper Neutralization of Argument Delimiters in a Command.

Root Cause

The root cause is unsafe pass-through of user-controlled arguments into a subprocess launch. The API server treated extra_args as trusted browser tuning input rather than sensitive command-line data. The Docker deployment additionally shipped without authentication enabled by default, allowing any network-reachable client to submit crafted requests.

Attack Vector

Exploitation requires only network access to the Crawl4AI Docker API endpoint. The attacker submits a crawl request whose browser_config.extra_args contains Chromium switches that redirect child-process execution. When Crawl4AI launches Chromium to service the request, Chromium executes the attacker's chosen command in place of the expected subprocess.

text

// Patch: Dockerfile version bump to 0.9.0 hardened build
 FROM python:3.12-slim-bookworm AS build
 
 # C4ai version
-ARG C4AI_VER=0.8.9
+ARG C4AI_VER=0.9.0
 ENV C4AI_VERSION=$C4AI_VER
 LABEL c4ai.version=$C4AI_VER

Source: GitHub Commit 60886d1

Detection Methods for CVE-2026-57572

Indicators of Compromise

HTTP requests to Crawl4AI API endpoints containing extra_args values with --no-zygote, --renderer-cmd-prefix, or --browser-subprocess-path
Chromium parent processes spawning unexpected child binaries such as sh, bash, curl, wget, or python inside the Crawl4AI container
Outbound network connections initiated by Crawl4AI containers to unfamiliar destinations shortly after crawl requests
Unexpected file writes under /tmp or the container's writable layers correlated with API traffic

Detection Strategies

Inspect API request bodies at the ingress or reverse proxy layer for Chromium switches inside browser_config.extra_args
Monitor process ancestry inside Crawl4AI containers and alert when Chromium spawns non-browser executables
Correlate API request timestamps with new outbound connections or shell invocations in container runtime telemetry

Monitoring Recommendations

Enable container runtime logging with process-level visibility (execve auditing) on hosts running Crawl4AI
Forward container logs and process telemetry to a centralized data lake for retrospective hunting against the switch names listed above
Alert on any Crawl4AI container process running as a shell interpreter or reaching internet destinations outside the crawl target scope

How to Mitigate CVE-2026-57572

Immediate Actions Required

Upgrade Crawl4AI to version 0.9.0 or later, which hardens the Docker server and rejects unsafe extra_args values
Rebuild and redeploy container images using the updated C4AI_VER=0.9.0 build argument
Restrict network access to the Crawl4AI API so it is not reachable from untrusted networks or the public internet
Enable authentication on the Docker API server and rotate any secrets accessible from compromised containers

Patch Information

The fix is delivered in Crawl4AI 0.9.0 via commit 60886d1a0c52682e4c83a7cef9dfac417fff6bd2, which merges the secure-by-default Docker server hardening branch. Details are documented in the GitHub Security Advisory GHSA-r253-r9jw-qg44 and the upstream commit.

Workarounds

Place the Crawl4AI API behind an authenticating reverse proxy that strips or rejects browser_config.extra_args in incoming requests
Run the Crawl4AI container as an unprivileged user with a read-only root filesystem and no outbound egress beyond required crawl targets
Apply an allowlist at the application boundary permitting only known-safe Chromium switches until the upgrade to 0.9.0 is complete

bash

# Example: block requests containing dangerous Chromium switches at an nginx reverse proxy
location /crawl {
    if ($request_body ~* "(--no-zygote|--renderer-cmd-prefix|--browser-subprocess-path)") {
        return 403;
    }
    proxy_pass http://crawl4ai-backend;
}