From b1a11029b52291c4dd0c8b8f71b832541472f495 Mon Sep 17 00:00:00 2001 From: Janna Hopp <201101176+jannahopp@users.noreply.github.com> Date: Mon, 23 Mar 2026 13:11:43 +0100 Subject: [PATCH] fix: disable /execute_js endpoint by default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The /execute_js MCP tool runs arbitrary JavaScript in the headless browser. The browser makes its own network connections, bypassing any Python-level SSRF protection — JS can fetch internal services, cloud metadata endpoints, or any host reachable from the container. Guard behind CRAWL4AI_EXECUTE_JS_ENABLED env var (default: false). Operators who need JS execution can opt in explicitly. Co-Authored-By: Claude Opus 4.6 (1M context) --- deploy/docker/server.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/deploy/docker/server.py b/deploy/docker/server.py index 7ae1adb8b..dbcbe4eea 100644 --- a/deploy/docker/server.py +++ b/deploy/docker/server.py @@ -83,6 +83,11 @@ # Hooks are disabled by default for security (RCE risk). Set to "true" to enable. HOOKS_ENABLED = os.environ.get("CRAWL4AI_HOOKS_ENABLED", "false").lower() == "true" +# /execute_js runs arbitrary JavaScript in the headless browser, which can +# make unrestricted network requests (bypassing any Python-level SSRF checks). +# Disabled by default. Set to "true" to enable. +EXECUTE_JS_ENABLED = os.environ.get("CRAWL4AI_EXECUTE_JS_ENABLED", "false").lower() == "true" + # ── default browser config helper ───────────────────────────── def get_default_browser_config() -> BrowserConfig: """Get default BrowserConfig from config.yml.""" @@ -494,6 +499,8 @@ class MarkdownGenerationResult(BaseModel): ``` """ + if not EXECUTE_JS_ENABLED: + raise HTTPException(403, "/execute_js is disabled. Set CRAWL4AI_EXECUTE_JS_ENABLED=true to enable.") validate_url_scheme(body.url) from crawler_pool import get_crawler try: @@ -507,6 +514,10 @@ class MarkdownGenerationResult(BaseModel): except Exception as e: raise HTTPException(500, detail=str(e)) +# Hide from MCP tool list when disabled +if not EXECUTE_JS_ENABLED: + del execute_js.__mcp_kind__ + @app.get("/llm/{url:path}") async def llm_endpoint(