Description
Crawl4AI 是一个开源的 AI 爬虫工具。Crawl4AI 0.8.0 版本之前在 Docker API 部署中存在远程代码执行漏洞。攻击者可以通过 /crawl 端点传入 hooks 参数包含 Python 代码，从而执行任意系统命令。
Crawl4AI /crawl hooks 代码执行漏洞（CVE-2026-26216）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2026-26216
https://github.com/advisories/GHSA-5882-5rx9-xgxp
https://www.vulncheck.com/advisories/crawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameter
https://access.redhat.com/security/cve/cve-2026-26216
https://www.cve.org/CVERecord?id=CVE-2026-26216
https://avd.aliyun.com/detail?id=AVD-2026-26216
https://nosec.org/m/share/5942.html
https://cve.imfht.com/detail/CVE-2026-26216
https://www.endorlabs.com/vulnerability/cve-2026-26216