CVE-2026-91942: crawl4ai Docker Playground XSS Vulnerability

CVE-2026-91942 Overview

CVE-2026-91942 is a DOM-based cross-site scripting vulnerability [CWE-79] affecting crawl4ai versions before 0.9.3. The flaw resides in the Docker Playground UI, which assigns untrusted crawl results directly to an element.innerHTML property. Attackers can craft malicious PDF documents containing event-handler markup that executes JavaScript in the Playground origin. Successful exploitation lets adversaries steal API tokens from sessionStorage and abuse authenticated API endpoints on behalf of the victim.

Critical Impact
Attackers can execute arbitrary JavaScript in the Playground origin, exfiltrate API tokens from sessionStorage, and pivot to authenticated API abuse against the crawl4ai backend.

Affected Products

crawl4ai versions prior to 0.9.3
crawl4ai Docker Playground UI component
Deployments exposing the Playground interface to untrusted crawl targets

Discovery Timeline

2026-09-15 - CVE-2026-91942 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91942

Vulnerability Analysis

The vulnerability originates in the crawl4ai Docker Playground UI, a browser-based interface that renders results returned by the crawler backend. The UI passes crawl output directly into a DOM element via innerHTML without sanitizing untrusted content. Because innerHTML parses HTML and honors inline event handlers such as onerror and onload, any markup embedded in a crawl result executes in the Playground origin. An attacker controls the input by hosting a malicious PDF that crawl4ai processes and returns to the Playground UI. Once executed, the payload runs with full access to the Playground's Document Object Model (DOM) and browser storage. Sensitive material stored in sessionStorage, including API tokens used to authenticate against the crawl4ai backend, becomes readable by the attacker's script. The stolen tokens enable subsequent API calls impersonating the victim.

Root Cause

The root cause is unsafe DOM manipulation in the Playground UI. Untrusted crawl output is assigned to element.innerHTML rather than being inserted as text or sanitized through a trusted-types policy or an HTML sanitizer. This violates output-encoding practices for [CWE-79].

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a crafted PDF containing event-handler HTML markup. A Playground user submits the PDF's URL for crawling, and the returned content is rendered through innerHTML. The embedded handler fires, executing attacker JavaScript that reads sessionStorage and exfiltrates API tokens to an attacker-controlled endpoint.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-7g3g-vhm6-79f3 and the VulnCheck Cross-Site Scripting Advisory for advisory details.

Detection Methods for CVE-2026-91942

Indicators of Compromise

Outbound requests from Playground user sessions to unfamiliar domains shortly after submitting a crawl job
Crawl results containing inline event-handler attributes such as onerror=, onload=, or onclick= embedded in returned HTML
Unexpected API activity using tokens tied to Playground users originating from atypical IP addresses or user agents

Detection Strategies

Inspect crawl output stored or logged by crawl4ai for HTML event-handler patterns and <script> tags returned from PDF sources
Monitor browser console errors and Content Security Policy violation reports from the Playground origin
Correlate crawl submissions of PDF URLs with subsequent anomalous API token usage against the crawl4ai backend

Monitoring Recommendations

Enable web server access logging on the Playground and alert on POST requests to backend APIs from unexpected sources
Instrument the Playground with CSP report-only headers to surface inline script execution attempts
Track version inventory of crawl4ai deployments and flag any instance below 0.9.3

How to Mitigate CVE-2026-91942

Immediate Actions Required

Upgrade crawl4ai to version 0.9.3 or later on all Docker Playground deployments
Rotate any API tokens that were stored in sessionStorage of the Playground during the vulnerable window
Restrict Playground access to trusted users and networks until patching is complete

Patch Information

The maintainers addressed the vulnerability in crawl4ai0.9.3. Refer to the GitHub Security Advisory GHSA-7g3g-vhm6-79f3 for fix details and upgrade guidance.

Workarounds

Disable or firewall the Docker Playground UI if an immediate upgrade is not feasible
Prevent Playground users from submitting untrusted PDF URLs by enforcing an allowlist of crawl targets
Deploy a strict Content Security Policy on the Playground origin that forbids inline script execution and event handlers

bash

# Upgrade crawl4ai to the patched release
pip install --upgrade "crawl4ai>=0.9.3"

# Verify the installed version
python -c "import crawl4ai; print(crawl4ai.__version__)"