{"action":"Upgrade crawl4ai to 0.9.0 or later.","affected":[{"fixed":"0.9.0","introduced":"0"}],"component":"crawl4ai","cve_ids":["CVE-2026-57572"],"ecosystem":"PyPI","epss":0.00939,"exploited":false,"fixed_versions":["0.9.0"],"ghsa_id":"GHSA-r253-r9jw-qg44","id":"tcs_01M5KGXPDAN3PQ59CRR7KVDKCK","modified_at":"2026-07-13T07:15:23.173179651Z","published_at":"2026-07-06T21:16:58.047Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2139","https://github.com/unclecode/crawl4ai/security/advisories/GHSA-r253-r9jw-qg44","https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"PYSEC-2026-2139","url":"https://osv.dev/vulnerability/PYSEC-2026-2139"}],"summary":"Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch argument"}