Live › vulnerability › CVE-2026-119118
Crawl4AI launches Chromium with certificate errors ignored, so a network attacker can impersonate sites the crawler visits. The attacker can serve forged content and read cookies and headers the crawler sends.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Any deployment running Crawl4AI before 0.9.5 that fetches web pages over networks an attacker can observe or influence, such as shared networks or hosts that rely on DNS the attacker controls. Teams that only crawl trusted internal targets on isolated networks face less exposure. The sources do not say whether the sandbox override matters outside Docker or container setups.
No product ranges from the sources yet.
pip show crawl4ai and compare it against 0.9.5.--ignore-certificate-errors in the Chromium launch arguments of the crawler configuration.0.9.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.
This page as .md · .json · in your agent: get_signal("CVE-2026-119118")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.