---
title: "GHSA-r253-r9jw-qg44: Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args"
url: https://erroneo.us/security/ghsa/GHSA-r253-r9jw-qg44/
description: "GHSA-r253-r9jw-qg44 (critical, PyPI): Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browserconfig.extraargs. Summary The Docker…"
type: advisory
section: "Security Digest"
date_published: 2026-06-18
date_modified: 2026-06-18
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-r253-r9jw-qg44"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-r253-r9jw-qg44: Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

## Affected packages

- PyPI `crawl4ai` <= 0.8.9 → fixed: 0.9.0

## Details

Summary The Docker API server accepted a request-supplied browserconfig.extraargs, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command (--utility-cmd-prefix, --renderer-cmd-prefix, --gpu-launcher, --browser-subprocess-path) together with --no-zygote, causing Chromium to fork/exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. The earlier extraargs SSRF patch (0.8.9) used a denylist scoped to proxy/DNS flags; a denylist of launch switches is inherently incomplete, and these command-execution switches were not covered. Affected paths /crawl, /crawl/stream, /crawl/job accepting a request browserconfig.extraargs. Impact Unauthenticated remote code execution as the container runtime user; full read/write of application data, mounted secrets, environment, and tokens, and out-of-band exfiltration independent of the HTTP response. Fix 0.9.0 establishes a trust boundary for request-supplied configuration: extraargs (along with other power fields such as proxy, userdatadir, cdpurl, initscripts) is a forbidden field for untrusted request bodies. Any request that sets extraargs is rejected with HTTP 400 rather than scrubbed against an always-incomplete denylist. In-process SDK callers (trusted) are unaffected. Workarounds - Upgrade to the patched version (0.9.0). - Enable authentication (CRAWL4AIAPITOKEN) and restrict who can reach the API. - Run the container with a restrictive seccomp profile and no ability to exec helper binaries. Credits Y4tacker - reported the --no-zygote + --utility-cmd-prefix command-injection chain with a confirmed in-container PoC and an allowlist/reject recommendation. UDURisePho (hoanggxyuuki) - independently reported the request-supplied Chromium launch-flag RCE class (--renderer-cmd-prefix), confirmed still reproducing on 0.8.9.

## Sources

- [GitHub Advisory GHSA-r253-r9jw-qg44](https://github.com/advisories/GHSA-r253-r9jw-qg44)
- [github.com](https://github.com/unclecode/crawl4ai/security/advisories/GHSA-r253-r9jw-qg44)

---
Source page: https://erroneo.us/security/ghsa/GHSA-r253-r9jw-qg44/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt