CVE-2026-119118 Details
Description
Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.
An improper certificate validation vulnerability has been identified in Crawl4AI versions prior to 0.9.5. This vulnerability allows network attackers to intercept crawls because the application launches Chromium with the '--ignore-certificate-errors' flag, disabling proper TLS verification. As a result, man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and access cookies and headers from the requests. Additionally, the hard-coded '--no-sandbox' flag overrides the 'CRAWL4AI_CHROMIUM_SANDBOX' setting, leaving the browser without a renderer sandbox.
Update Crawl4AI to version 0.9.5 or later, where this vulnerability has been patched. In the patched version, the insecure certificate error flags have been removed from the default launch options, and the 'CRAWL4AI_CHROMIUM_SANDBOX' setting is properly applied to all browser instances.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-improper-certificate-validation-via-hard-coded-chromium-flags | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| unclecode Crawl4AI | <= 0.9.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |