Server-side Request Forgery (SSRF) Affecting crawl4ai package, versions [,0.9.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-CRAWL4AI-17661145
- published28 Jun 2026
- disclosed18 Jun 2026
- creditseankohjs
Introduced: 18 Jun 2026
New CVE NOT AVAILABLE CWE-918 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade Crawl4AI to version 0.9.0 or higher.
Overview
Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the handle_stream_crawl_request process. An attacker can access internal-only services and cloud-metadata endpoints by sending crafted requests to the affected API endpoints, causing the server to fetch and stream responses from arbitrary internal URLs.