The flaw in Crawl4AI lies in the Docker API server’s handling of request-supplied browser_config.extra_args. Prior to version 0.9.0, these arguments were forwarded directly to Chromium’s launch options, allowing an attacker to inject Chromium switches that replace the child‑process launch command and enable the --no‑zygote flag. By doing so, the attacker can force Chromium to fork or exec an arbitrary command as the container’s runtime user. Because the Docker API is unauthenticated by default, any user who can reach the API can trigger this behavior. The vulnerability corresponds to input injection (CWE‑88) and command injection (CWE‑94).

All installations of Crawl4AI built before version 0.9.0 are affected. This includes every instance that uses the open‑source crawler and scraper, regardless of deployment environment, as long as the Docker API remains unprotected. The vendor for the product is unclecode, identified by the CPE entry "unclecode:crawl4ai".

The CVSS base score of 10 indicates that an attacker can achieve full code execution inside the container without privilege escalation or lateral movement. The EPSS score of < 1% reflects a very low probability of exploitation, noting that exploitation occurs when an unauthenticated user sends a crafted browser_config.extra_args payload to the Docker API. The vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication on the API endpoint invites potentially high-impact attacks. Attackers can exploit this by sending a single specially crafted request to the unauthenticated Docker API endpoint that contains malicious browser_config.extra_args, which the server forwards to Chromium and ultimately executes within the container context.