Crawl4AI 0.9.4 Patch Fixes Critical SSRF Flaw in Web Scraping Library

The National Vulnerability Database has published details for CVE-2026-109238, a critical security flaw affecting the Crawl4AI web scraping library. This server-side request forgery vulnerability allows attackers to trick the software into accessing internal network resources. The issue impacts all versions of the library released before version 0.9.4, according to the NVD record.

The flaw carries a CVSS score of 9.2, which the NVD classifies as critical. It maps to CWE-918, indicating a server-side request forgery weakness. By enabling the link_preview_config setting on crawl requests, API clients can supply controlled pages that trigger the vulnerability. This allows an attacker to bypass normal access controls and reach private internal addresses that should not be exposed to external users.

Technical Context

The vulnerability exists within the AsyncUrlSeeder component of Crawl4AI. When an attacker sets specific parameters, including include_external and include_patterns, the component fetches links from the supplied page. This process causes the library to retrieve and parse head data from internal, private, and cloud-metadata links. The returned data can then be accessed by the attacker, potentially exposing sensitive infrastructure details.

The NVD description notes that the flaw allows API clients to reach internal addresses. This occurs because the library processes the configured patterns without sufficient validation of the target destinations. As a result, the AsyncUrlSeeder component acts as a proxy for requests to sensitive internal endpoints, including cloud metadata services that often contain authentication credentials.

Affected Software

The vulnerability affects the Crawl4AI library developed by unclecode. Any deployment using version 0.7.0 or any subsequent release before version 0.9.4 is considered vulnerable. The NVD record explicitly states that versions prior to 0.9.4 contain this flaw. Users of the library in production environments or development pipelines are at risk if they have not updated to the patched version.

There is no indication in the source material that the flaw has been widely exploited in the wild. However, the critical severity rating suggests that the potential impact is significant. Organizations using Crawl4AI for automated web scraping or data extraction should verify their current version immediately. The risk is highest for systems where the library is exposed to untrusted API clients or external inputs.

What should you do?

Security teams should audit their environments for any installations of Crawl4AI. If the library is present, administrators must check the version number against the vulnerable range. Users should prioritize updating to version 0.9.4 or later to mitigate the risk. Until an update is applied, restricting API access to trusted sources can reduce the attack surface.