CVE-2026-91944 Overview
CVE-2026-91944 is a DOM-based cross-site scripting vulnerability [CWE-79] affecting crawl4ai versions before 0.9.3. The flaw resides in the Playground UI, where the forceHighlightElement() function reassigns textContent back to innerHTML. This operation causes JSON responses returned by the crawler to be re-parsed as HTML in the operator's browser. Attackers control crawled page content such as the page title, allowing them to inject scripts that execute in the Playground context. Successful exploitation lets an attacker exfiltrate the operator's API token from sessionStorage and gain full control of the crawl4ai server.
Critical Impact
Injected scripts run in the operator's Playground session and can steal the API token from sessionStorage, enabling full server takeover.
Affected Products
- crawl4ai versions prior to 0.9.3
- crawl4ai Playground UI component
- Deployments that expose the Playground interface to operators crawling untrusted sites
Discovery Timeline
- 2026-09-15 - CVE-2026-91944 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91944
Vulnerability Analysis
The Playground UI in crawl4ai renders JSON responses returned by the crawler back into the DOM. The forceHighlightElement() helper reads a node's textContent and then reassigns that value to innerHTML. Assigning a string to innerHTML causes the browser to parse the string as HTML markup, so any HTML tags contained in crawler output become live DOM nodes. When the crawler retrieves an attacker-controlled page, hostile markup embedded in fields such as the page title flows through the response and into the operator's browser as executable script.
Because the sink runs inside the authenticated Playground session, injected JavaScript inherits the operator's origin and can read from sessionStorage. The Playground stores the API token there, so a single payload can exfiltrate the token to an attacker-controlled endpoint. With the API token, the attacker can drive the crawl4ai server, submit new crawl jobs, and pivot to server-side actions the operator is authorized to perform.
Root Cause
The root cause is unsafe reintroduction of user-controlled data into an HTML sink. Reading textContent produces a safe string, but writing that same string to innerHTML re-enables HTML parsing and defeats prior escaping. Crawler output from third-party pages is treated as trusted UI content instead of untrusted input requiring sanitization or DOM-safe rendering.
Attack Vector
Exploitation requires an operator to crawl an attacker-controlled or attacker-influenced URL through the Playground. The attacker hosts a page whose title or other rendered field contains an HTML payload. When the JSON response is displayed and forceHighlightElement() executes, the payload is parsed as HTML and any embedded script runs. User interaction is required to initiate the crawl, but no authentication to the attacker's page is needed. Refer to the GitHub Security Advisory and the VulnCheck Advisory on XSS for additional detail.
Detection Methods for CVE-2026-91944
Indicators of Compromise
- Outbound HTTP requests from the operator's browser to unfamiliar domains shortly after a Playground crawl completes.
- Crawl responses containing <script> tags, inline event handlers such as onerror=, or javascript: URIs inside title or metadata fields.
- Unexpected API calls to the crawl4ai server authenticated with the operator's token from new source addresses.
Detection Strategies
- Inspect crawler JSON responses for HTML control characters in fields rendered by the Playground UI, particularly page titles and metadata.
- Review browser developer console logs and Content Security Policy (CSP) violation reports generated during Playground sessions.
- Correlate crawl job history with subsequent API token usage to identify tokens exercised outside expected operator workflows.
Monitoring Recommendations
- Log all authenticated API requests to the crawl4ai server with source IP and user agent, and alert on deviations from operator baselines.
- Monitor for crawl4ai instances running versions earlier than 0.9.3 using software inventory data.
- Capture browser telemetry from workstations that operate the Playground UI to identify anomalous script execution or storage access.
How to Mitigate CVE-2026-91944
Immediate Actions Required
- Upgrade crawl4ai to version 0.9.3 or later on every host running the Playground UI.
- Rotate any API tokens that were present in sessionStorage on operator workstations while a vulnerable version was in use.
- Restrict Playground access to trusted operators and place the interface behind network controls or a reverse proxy that enforces authentication.
Patch Information
The crawl4ai maintainers fixed the vulnerability in version 0.9.3. The upstream advisory is published at the GitHub Security Advisory. Operators should update from the official package index and redeploy any container images built on affected releases.
Workarounds
- Avoid crawling untrusted or attacker-influenced URLs from the Playground UI until the upgrade is complete.
- Disable or block the Playground UI in production deployments and use the API directly for automated workflows.
- Enforce a strict Content Security Policy that disallows inline script execution in the Playground origin to reduce the impact of DOM-based script injection.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
