Server-side Request Forgery in Crawl4AI PDFContentScrapingStrategy

CVE-2026-91943

What is CVE-2026-91943?

Crawl4AI versions prior to 0.9.3 are susceptible to a server-side request forgery vulnerability found in the PDFContentScrapingStrategy component. This flaw allows authenticated attackers to manipulate the _get_pdf_path() function, leading to the re-fetching of targets through Python requests without proper egress filtering. By providing crafted URLs, attackers can redirect requests to internal network addresses or exploit DNS rebinding techniques, potentially gaining access to restricted internal services. The vulnerability can facilitate the extraction of sensitive data through PDF text outputs in the crawl results, posing a significant risk to the affected systems.

References