GHSA-7cx2-g3h9-382p: Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
(updated )
Three backward-compatible hardening fixes in the Docker API server. The headline issue is an arbitrary file write via the screenshot/PDF output_path.
References
- github.com/advisories/GHSA-7cx2-g3h9-382p
- github.com/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-228.yaml
- github.com/unclecode/crawl4ai/issues/1
- github.com/unclecode/crawl4ai/issues/2
- github.com/unclecode/crawl4ai/pull/3
- github.com/unclecode/crawl4ai/security/advisories/GHSA-7cx2-g3h9-382p
- www.vulncheck.com/advisories/crawl4ai-arbitrary-file-write-via-output-path-symlink-and-toctou
Code Behaviors & Features
Detect and mitigate GHSA-7cx2-g3h9-382p with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →