The flaw lies in the handling of request-provided browser_config.extra_args in Crawl4AI's Docker API server. Prior to version 0.9.0 these arguments were passed straight into Chromium's launch options, allowing an attacker to inject Chromium switches that replace a child‑process launch command and enable --no‑zygote. This gives the attacker the ability to force Chromium to fork or exec an arbitrary command as the container runtime user. Because the Docker API is unauthenticated by default, anyone who can reach the API can trigger inside the container. The weakness corresponds to input validation failures (C) and command injection (CWE‑94).

The vulnerability affects all installations of Crawl4AI built before version 0.9.0. This includes every instance that uses the open‑source crawler and scraper, regardless of deployment environment, as long as the Docker API remains unprotected. No other products beyond the Crawl4AI project are listed. Upgrading to version 0.9.0 or newer eliminates the flaw.

The CVSS base score is 10, reflecting that an attacker can gain full code execution without privilege escalation or lateral movement. The EPSS score of < 1% indicates a very low probability of exploitation, as the score exists but is in the interval (0%,1%) and is not null. The unauthenticated API and high severity still make this a high‑priority issue. The vulnerability is not listed in CISA's KEV catalog. Attackers can exploit it by sending a specially crafted request to the unauthenticated Docker API endpoint that contains malicious browser_config.extra_args, which the server forwards to Chromium and ultimately executes within the container context.