CVE-2026-56264

Received Received - Intake

BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute_js endpoint, which accepts and executes arbitrary user-supplied JavaScript in the server's browser context with --disable-web-security enabled. An attacker can execute arbitrary JavaScript and, combined with the browser's relaxed security settings, perform server-side request forgery against internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56264

EUVD

EUVD-2026-40431

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Crawl4AI before version 0.8.7 has a security flaw in its Docker API server's /execute_js endpoint. This endpoint allows execution of arbitrary JavaScript code supplied by a user within the server's browser context. Because the browser is run with the --disable-web-security flag enabled, it relaxes normal security restrictions, enabling an attacker to execute malicious JavaScript.

This vulnerability can be exploited to perform server-side request forgery (SSRF) attacks against internal services by leveraging the browser's relaxed security settings.

Impact Analysis

An attacker exploiting this vulnerability can execute arbitrary JavaScript code on the server, potentially leading to unauthorized actions or data access.

Additionally, the attacker can perform server-side request forgery (SSRF) attacks, which may allow them to access internal services that are not normally exposed externally.

The CVSS scores indicate a high severity, with impacts on confidentiality, integrity, and availability, meaning the vulnerability can lead to significant compromise of the affected system.

Hi! I’m here to help you understand CVE-2026-56264. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70