By vendor
Kidocode vulnerabilities
Known CVEs affecting Kidocode products, prioritized by severity, with SEC.co remediation and detection guidance.
9 published vulnerabilities
- CVE-2026-53755HIGH 8.6
Crawl4AI is a web crawler tool designed to work well with AI language models. In versions before 0.8.9, the Docker-based API server had a critical flaw: it blocked requests trying to crawl internal IP addresses, but this protection didn't apply to proxy servers. An attacker could send a normal-looking crawl request that appears to target a legitimate external website, but configure a proxy to route the traffic through internal networks or cloud metadata services. Since the Docker API requires no authentication by default, anyone with network access could exploit this to discover internal services or steal cloud credentials.
- CVE-2026-56261HIGH 8.6
Crawl4AI, a web crawling and data extraction framework, contains a vulnerability that allows attackers to trick the application into making requests to internal services it shouldn't access. When you submit a crawling or LLM job, you can specify a webhook URL where results should be sent back. The vulnerability exists because the application doesn't properly validate these URLs—an attacker can provide a webhook address pointing to private networks, internal IP ranges, or cloud metadata services. This causes the Crawl4AI server to reach out to those internal systems on behalf of the attacker, potentially leaking sensitive information like cloud credentials or internal service data.
- CVE-2026-56266HIGH 8.6
Crawl4AI, a web scraping and content processing tool, contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs. By crafting IPv6-mapped IPv4 addresses, attackers can bypass the application's blocklist protections and reach internal services or cloud metadata endpoints—such as AWS Instance Metadata Service—that should be inaccessible. This affects versions prior to 0.8.7.
- CVE-2026-57573HIGH 8.6
Crawl4AI, an open-source web crawler designed for large language models, contains a server-side request forgery (SSRF) vulnerability in versions before 0.9.0. When deployed as a Docker API server, the application validates destination URLs on its standard crawl endpoint but fails to perform the same check on its streaming variant. This allows unauthenticated attackers to submit requests to the streaming path that direct the server to fetch and stream back content from internal networks, private IP ranges, or link-local addresses that should be inaccessible to external clients.
- CVE-2026-56258HIGH 8.1
Crawl4AI, a web scraping and automation framework, contains a flaw that allows attackers to write files anywhere on a system without authentication. The vulnerability exists in features that take screenshots and generate PDFs. Attackers can exploit this by manipulating file path parameters and using symlinks (shortcuts to files and directories) to bypass safety checks, potentially leading to system compromise if the application runs with elevated privileges.
- CVE-2026-56264HIGH 8.1
Crawl4AI, a web scraping and automation tool, contains a critical flaw in versions before 0.8.7 that allows attackers to execute arbitrary JavaScript code on the server. The vulnerability exists in the /execute_js endpoint of the Docker API server, which was designed to run JavaScript but does so without proper security controls. Because the underlying browser runs with disabled security protections (--disable-web-security), an attacker can not only run malicious scripts but also abuse the server to attack internal systems on the network that it can reach—a technique known as server-side request forgery (SSRF).
- CVE-2026-53754HIGH 7.5
Crawl4AI, an open-source web crawler designed to work with large language models, contains a server-side request forgery (SSRF) vulnerability in its Docker API server. The vulnerability stems from incomplete IP address filtering that allows attackers to bypass security controls and access internal services and cloud metadata endpoints. Because the Docker API runs without authentication by default, an attacker can exploit this flaw remotely without credentials to reach sensitive internal systems.
- CVE-2026-56262MEDIUM 6.5
Crawl4AI, a web crawling and monitoring library, contains a security flaw that allows anyone on the network to perform damaging operations without logging in. Specifically, attackers can reach an administrative cleanup endpoint and disrupt the monitoring service's state, potentially causing outages or data loss. This affects versions before 0.8.7.
- CVE-2026-56263MEDIUM 6.1
Crawl4AI, a web crawling framework, contains a stored cross-site scripting (XSS) vulnerability in its monitoring dashboard. An attacker can craft a malicious crawl request containing JavaScript code. When a dashboard operator views the crawl results, the malicious code executes in their browser without being sanitized, potentially allowing the attacker to steal session tokens, redirect the operator to phishing sites, or perform actions on their behalf. The vulnerability affects versions prior to 0.8.7.