CVE-2026-119121 Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119121?
CVE-2026-119121 is a medium-severity vulnerability in unclecode crawl4ai, published on 29 Oct 2026.
Official description
Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for, bypassing the js_code block to alter page state and returned crawl content.
Weakness: CWE-95
Which versions are affected by CVE-2026-119121?
How do I fix CVE-2026-119121?
No fix has been published for CVE-2026-119121 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119121 being exploited?
There is no known exploitation of CVE-2026-119121 in the wild and no public exploit code.
Sources
Also known as GHSA-6fxw-998x-jq4q, GHSA-qj46-wp7m-rgj8.