{"action":"Upgrade crawl4ai to 0.9.0 or later.","affected":[{"fixed":"0.9.0","introduced":"0"}],"component":"crawl4ai","cve_ids":["CVE-2026-57571"],"ecosystem":"PyPI","epss":0.00809,"exploited":false,"fixed_versions":["0.9.0"],"ghsa_id":"GHSA-2jq4-q6vv-4cp3","id":"tcs_01M5KGXP8S1TN4X9RAQ1JWX1RN","modified_at":"2026-07-13T07:15:22.880349795Z","published_at":"2026-07-06T21:16:57.907Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2138","https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2","https://github.com/unclecode/crawl4ai/security/advisories/GHSA-2jq4-q6vv-4cp3"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"PYSEC-2026-2138","url":"https://osv.dev/vulnerability/PYSEC-2026-2138"}],"summary":"Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined"}