The vulnerability is a DOM‑based cross‑site scripting flaw in the Docker Playground UI of crawl4ai. Untrusted crawl results are assigned directly to an element’s innerHTML, allowing attackers to inject malicious JavaScript. When a victim opens a crafted PDF containing event‑handler markup, the script runs in the Playground origin and can read tokens stored in sessionStorage, enabling unauthorized API calls at the victim’s credential level.

The affected product is crawl4ai, developed by unclecode, in all releases prior to version 0.9.3. No further product or version granularity is provided in the data.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Attackers would need to lure a user into opening the Docker Playground UI and triggering the embedded malicious script via a PDF file, making the vector impact limited to the current session’s authentication context, but it permits exploitation of the victim’s API tokens.