Root cause
Injection & unsafe execution
The LLM configuration combines a caller-selected base URL with a provider credential read by the server.
Crawl4AI combined a caller-selected provider URL with server-held credentials. A later repair restores server-controlled destinations and credentials when processing untrusted request configuration.
How AI contributed: Flawed AI-written codePublished Jun 4, 2026 in 
unclecode/crawl4aiAll 2 findings in this repository
Provisional finding. Full causal and release verification remains incomplete.
Fix
Security fix
The repaired path takes both the API token and base URL from the server-resolved LLM configuration.
Case facts
- CVE ID
- CVE-2026-56259
- GHSA ID
- GHSA-MW9F-Q68P-364X
- Published
- Jun 4, 2026
- Severity
- high
- Language
- Python
- AI tool
Claude- AI role
- Flawed AI-written code
- Vulnerable release
- 0.8.7 and 0.8.8 (retained incomplete states)
- Fixed release
- docker-rebuild-v0.9.0
AI-assisted change
AI-assisted changedeploy/docker/api.pysource unclecode/crawl4ai@480d938f67+3−3
@@ -125,7 +127,7 @@ prompt_with_variables=prompt,- api_token=get_llm_api_key(config), # Returns None to let litellm handle it- temperature=get_llm_temperature(config),- base_url=get_llm_base_url(config),+ api_token=get_llm_api_key(config, resolved_provider),+ temperature=temperature or get_llm_temperature(config, resolved_provider),+ base_url=base_url or get_llm_base_url(config, resolved_provider), base_delay=config["llm"].get("backoff_base_delay", 2), max_attempts=config["llm"].get("backoff_max_attempts", 3), exponential_factor=config["llm"].get("backoff_exponential_factor", 2)The LLM configuration combines a caller-selected base URL with a provider credential read by the server.
Security fix
Fixdeploy/docker/api.pysource unclecode/crawl4ai@60886d1a0c+6−4
@@ -156,12 +171,14 @@- provider=resolved_provider,+ provider=llm["provider"], prompt_with_variables=prompt,- api_token=get_llm_api_key(config, resolved_provider),- temperature=temperature or get_llm_temperature(config, resolved_provider),- base_url=get_llm_base_url(config, resolved_provider), # ignore request base_url (key-exfil vector)+ api_token=llm["api_token"],+ temperature=temperature or llm["temperature"],+ base_url=llm["base_url"], base_delay=config["llm"].get("backoff_base_delay", 2),Show 8 hidden lines
max_attempts=config["llm"].get("backoff_max_attempts", 3), exponential_factor=config["llm"].get("backoff_exponential_factor", 2) ) return response.choices[0].message.content+ except LLMProviderNotAllowed as e:+ raise HTTPException(status_code=400, detail=str(e)) except Exception as e:The repaired path takes both the API token and base URL from the server-resolved LLM configuration.
Patch fingerprints
AI-assisted change 1b52ab0f8c4c887135d179d5e363293e3dac5969fd3cf2e1792e816de62a136f · Fix 79a3c0fcb0023af9002fc4595a0d732ab216017a70d49fa7d586cc7afed658af