crawl4ai · Issues· 201 open

[docs] DOM XSS: unescaped innerHTML interpolation in docs/apps/linkdin graph view template (5 sinks)

[Bug]: MCP SSE transport rejects concurrent requests on connect with "Received request before initialization was complete" (-32602)

[Bug]: Playground Advanced Config panel is non-functional — still sends the removed `code` protocol to /config/dump

[Bug]: browser_mode=builtin fails with "CDP endpoint not ready" — Chromium segfaults (SIGSEGV) when spawned from gunicorn worker (v0.9.3)

[Bug]: Disallow: /*? in robots.txt blocks the whole website.

Clarify supported versions in SECURITY.md after v0.9.2 release

[Bug]: BFSDeepCrawlStrategy re-scans the full level for parent lookup (O(n²)); BestFirstCrawlingStrategy can enqueue the same URL twice

page_timeout is silently capped at 60s over HTTP with no way to raise it

Discord GitHub Notifications fails for every new stargazer

[Bug]: DefaultTableExtraction drops <th> row headers and ignores rowspan, producing misaligned result.tables

ManagedBrowser SEGV_ACCERR crash with --disable-features=OptimizationHints in --headless=new (macOS arm64)

[Bug]: Pooled browsers get ~5 s/navigation slower with use, and the janitor never recycles a busy pool

[Bug]: Playground: /md and /llm endpoints always fail because Advanced Config `code` is sent to /config/dump

[Bug]: Browser pages and renderer processes accumulate for weeks on non-streaming /crawl (Docker 0.9.2)

[Bug]: MCP "ask" tool exposes an empty parameters schema ({"type":"object"} with no "properties"), rejected by strict tool-calling clients