CVE-2026-119118

6.5 MEDIUMpublic exploit available

Published 2026-10-29 · Updated 2026-10-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Weaknesses

CWE-295

Public exploit & PoC references

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q

All references

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q
https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-improper-certificate-validation-via-hard-coded-chromium-flags
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j2qh-f73r-mg3q

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2023-32198PoC
UNSCOREDCVE-2025-13833
MEDIUMCVE-2025-23390PoC
MEDIUMCVE-2026-100116
HIGHCVE-2026-100118
HIGHCVE-2026-100121
HIGHCVE-2026-100122
HIGHCVE-2026-100123

Related by shared AI tags and CWE weakness class. Browse the full archive.