unclecode shipped Crawl4AI v0.9.4 on 2026-09-23 (PyPI crawl4ai 0.9.4). It closes three coordinated advisories: blind SSRF via robots.txt (GHSA-f77g-77vp-r96v), SSRF with response disclosure via link_preview (GHSA-wh5w-hmj3-vgg7, high), and a dict-wrapper trust-boundary bypass that let non-admin clients read server env vars (GHSA-5w5p-vcv6-mm3f, high). A process-wide egress_policy wires the Docker PinningProxy into library HTTP clients. Default pruning switches to lxml-native PruningContentFilterLXML (~10×: 134→13 ms medium page; 2200→260 ms on a 6000-card page). Self-hosted Docker servers should upgrade.

Key Takeaways

  • ✓Shipped: v0.9.4 / PyPI 0.9.4; Docker: unclecode/crawl4ai:0.9.4
  • ✓Security: three GHSAs closed; robots + link_preview SSRF and env-leak via dict laundering; pinning egress proxy
  • ✓Perf: PruningContentFilterLXML default ~10× faster pruning with byte-identical output
  • ✓Ops: CRAWL4AI_MAX_TIMEOUT_MS; pool max_pages_before_recycle=200
  • ✓Install: docs.crawl4ai.com + pip install crawl4ai==0.9.4
🔗

Project Links & Resources

Direct Access
Direct access to official project resources and documentation
🐙
GitHub Release Crawl4AI v0.9.4
github.com/unclecode/crawl4ai/releases/tag/v0.9.4
↗
📖
PyPI crawl4ai 0.9.4
pypi.org/project/crawl4ai/0.9.4/
↗
🐙
CHANGELOG 0.9.4
github.com/unclecode/crawl4ai/blob/main/CHANGELOG.md
↗
🐙
GHSA-f77g-77vp-r96v robots SSRF
github.com/unclecode/crawl4ai/security/advisories/GHSA-f77g-77vp-r96v
↗
🐙
GHSA-wh5w-hmj3-vgg7 link_preview SSRF
github.com/unclecode/crawl4ai/security/advisories/GHSA-wh5w-hmj3-vgg7
↗
🐙
GHSA-5w5p-vcv6-mm3f env leak
github.com/unclecode/crawl4ai/security/advisories/GHSA-5w5p-vcv6-mm3f
↗
📖
Crawl4AI Installation Docs
docs.crawl4ai.com/core/installation/
↗
📖
Crawl4AI Docs Home
docs.crawl4ai.com/
↗
🔬

In-Depth Technical Analysis

Core Background & Industry Pain Points LLM/Agent crawlers often share a process between untrusted URLs and a server-side browser pool. SSRF can reach internal, loopback, and cloud-metadata addresses; link preview can even return parsed <head> content. Crawl4AI 0.9.3 hardened the PDF path, but robots.txt and the URL seeder still used standalone HTTP clients outside egress controls, and a dict-wrapper could launder forbidden types past the untrusted gate so non-admin clients read env secrets. ### Architecture Highlights & Internals v0.9.4 adds process-wide egress_policy.py: Docker registers its PinningProxy so library clients validate every hop and dial pinned IPs for robots/seeder (GHSA-f77g-77vp-r96v, GHSA-wh5w-hmj3-vgg7). Untrusted configs are re-checked after unwrap with caller provenance (GHSA-5w5p-vcv6-mm3f). Default pruning is lxml-native PruningContentFilterLXML (O(N), byte-identical to the old filter). ### Authoritative Benchmarks & Measured Scores Release notes report pruning wall times: medium page 134→13 ms, ~6000-card page 2200→260 ms (~10×). Security validation is GHSA closure plus unit/Docker tests—no cross-framework public throughput board. Acceptance: untrusted robots/seeder must not hit internal targets; prune output diff empty. ### Developer Hands-on Guide pip install crawl4ai==0.9.4 or docker pull unclecode/crawl4ai:0.9.4 (install docs). Set CRAWL4AI_MAX_TIMEOUT_MS and tune crawler.pool.max_pages_before_recycle (default 200). See PyPI and CHANGELOG.