Crawl4AI before version 0.8.7 stores crawl URLs and error messages directly into the monitor dashboard using innerHTML without escaping user‑supplied markup. This results in a stored cross‑site scripting vulnerability that can execute arbitrary JavaScript when an operator views the dashboard. An attacker who submits a specially crafted crawl request can embed malicious code within the crawl details, and that code will run in the browser of any logged‑in operator, potentially allowing credential theft or session hijacking. The impact is confined to the browser context of affected users and does not compromise the server itself.

The vulnerability affects the Crawl4AI application prior to release 0.8.7. Any installation of Crawl4AI that has not been upgraded to version 0.8.7 or later remains susceptible.

The CVSS v3.1 score of 5.3 indicates a medium level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Exploitation requires an attacker to be able to submit a crawl request that contains malicious markup, and the malicious code is only executed when an authorized operator views the monitor dashboard. While the attack surface is somewhat limited, the risk of cross‑site scripting to privileged users warrants timely remediation.