Threat reportVulnerabilityTL-2026-4871

ProjectDiscovery Neo disclosure: 22 CVEs across 13 open-source projects (incl. Crawl4AI CVE-2026-26216 unauthenticated RCE, CVSS 9.8-10.0)

criticalTRACKING

ProjectDiscovery Neo disclosure (TL-2026-4871), also tracked as ProjectDiscovery Neo 22 zero-days, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-31. It has no confirmed attribution, affects Crawl4AI (unclecode) Crawl4AI Docker API, references 22 CVEs (CVE-2026-28357, CVE-2026-28359, CVE-2026-26216), maps to 10 MITRE ATT&CK techniques (T1005, T1018, T1059.004), and is covered by 9 detection rules and 12 indicators of compromise.

CVSS
9.8/10Critical
CVEs
22Referenced vulnerabilities
Techniques
10MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
12Indicators of compromise

Key facts for TL-2026-4871

Threat ID
TL-2026-4871
Also known as
ProjectDiscovery Neo 22 zero-days
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
TRACKING
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, education, software-development, it-operations
Target regions
Global
Detection rules
9
Indicators of compromise
12

Malware and tooling in ProjectDiscovery Neo disclosure

Malware and tooling: ProjectDiscovery Neo

How ProjectDiscovery Neo disclosure works

ProjectDiscovery reports that its Neo AI security agent discovered and validated, with working exploits, 22 CVEs across 13 open-source projects including NocoDB, Crawl4AI, Gitea, SiYuan, Glances, changedetection.io, Budibase, Checkmate, ClaudecodeUI (Cloud CLI), Faraday, Chamilo LMS, AVideo and beautiful-mermaid. Several are network-reachable and unauthenticated (Crawl4AI RCE, Budibase auth bypass, ClaudecodeUI WebSocket RCE). None of the sources state in-the-wild exploitation.

On 2026-03-20 ProjectDiscovery (authors Andy Cao and Prince Chaddha) published research describing 22 vulnerabilities found by its Neo agent, which indexes a codebase, maps authentication boundaries, deploys the application in an isolated sandbox and produces proof-of-concept exploits verified with OAST callbacks or file-read confirmation. ProjectDiscovery states a roughly 10-20% false-positive rate and that all 22 CVEs were reported to the maintainers, most of them patched, with further findings still in disclosure.

The highest-impact issues are network-reachable. CVE-2026-26216 (Crawl4AI < 0.8.0, CWE-94): the Docker API /crawl endpoint accepts a 'hooks' parameter containing Python executed through exec(); because __import__ was left in the allowed builtins, an unauthenticated attacker can import os/subprocess/socket and run arbitrary commands. NVD scores it 10.0 (CVSS 3.1 and 4.0); the harness hunt skeleton cites 9.8. A public PoC appears in GHSA-5882-5rx9-xgxp. CVE-2026-26217 is a companion LFI via file:// URLs. CVE-2026-31816 (Budibase <= 3.31.4, CVSS 9.1): an unanchored regex tests ctx.request.url, so appending ?/webhooks/trigger to any endpoint bypasses JWT validation; ProjectDiscovery chained it to user enumeration, privilege escalation to admin via PATCH /api/global/users and mapping of internal Docker services (CouchDB on 5984). CVE-2026-31975 (ClaudecodeUI / Cloud CLI < 1.25.0, CVSS 9.8, CWE-78): a chain of a hardcoded fallback JWT secret, a platform-mode authentication path that assigns a generic platform-user identity, and a WebSocket shell handler that does not re-validate per message, resulting in unauthenticated shell access. CVE-2026-31861 (@siteboon/claude-code-ui <= 1.23.0) is a shell injection in /api/user/git-config via backticks or $() in gitName/gitEmail.

changedetection.io (<= 0.54.3, fixed 0.54.4) has CVE-2026-29039, where XPath 3.0 unparsed-text() reads arbitrary files through the include_filters field, and CVE-2026-29065, a Zip Slip via zipfile.extractall() allowing arbitrary file overwrite (the article describes an unauthenticated /import endpoint and overwriting an imported Python module for RCE; the GitHub advisory describes backup restore overwriting files such as the Flask secret key). The GitHub advisories rate both 8.8 High, while the article labels them Critical. CVE-2026-30875 (Chamilo LMS < 1.11.36, CVSS 8.8) lets an authenticated teacher upload a webshell via H5P import because only h5p.json presence is checked and .htaccess or alternate-extension PHP files are not blocked. The remaining CVEs are medium or high issues: stored and reflected XSS (NocoDB, changedetection.io, beautiful-mermaid), SSRF (Gitea OpenID discovery, SiYuan, Faraday), Glances SQL injection, unauthenticated config exposure and REST API access, Checkmate mass-assignment privilege escalation and unauthenticated status page access, and an unauthenticated IDOR in AVideo. Per-CVE severities beyond the NVD-verified ones are as labelled in the article.

Defenders should inventory these projects (many are self-hosted internal tools), upgrade to the fixed versions listed in each advisory, and restrict network exposure of management and API surfaces. No threat actor, C2 infrastructure or network IOCs are reported; the indicators below are exploit artifacts (endpoints, payload strings, filenames, package names) useful for log hunting.

MITRE ATT&CK techniques used in TL-2026-4871

Collection

T1005 Data from Local System

Discovery

T1018 Remote System Discovery; T1087 Account Discovery

Execution

T1059.004 Unix Shell; T1059.006 Python; T1059.007 JavaScript

Persistence

T1098 Account Manipulation; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Credentials In Files

Affected products and versions in ProjectDiscovery Neo disclosure

  • Crawl4AI (unclecode) — Crawl4AI Docker API
    Vulnerable versions: < 0.8.0
    Fixed in: 0.8.0
  • Budibase — Budibase
    Vulnerable versions: <= 3.31.4
  • changedetection.io — changedetection.io
    Vulnerable versions: <= 0.54.3
    Fixed in: 0.54.4
  • siteboon — Cloud CLI / ClaudecodeUI (@siteboon/claude-code-ui)
    Vulnerable versions: < 1.25.0 (CVE-2026-31975); <= 1.23.0 (CVE-2026-31861)
    Fixed in: 1.25.0; 1.24.0
  • Chamilo — Chamilo LMS
    Vulnerable versions: < 1.11.36
    Fixed in: 1.11.36
  • NocoDB — NocoDB
  • Gitea — Gitea
  • SiYuan — SiYuan
  • Glances — Glances
  • Checkmate — Checkmate

Remediation for ProjectDiscovery Neo disclosure

Patches

  • Crawl4AI 0.8.0
  • Cloud CLI / ClaudecodeUI 1.25.0 (CVE-2026-31975)
  • @siteboon/claude-code-ui 1.24.0 (CVE-2026-31861)
  • changedetection.io 0.54.4
  • Chamilo LMS 1.11.36
  • Budibase: version later than 3.31.4 (see GHSA-gw94-hprh-4wj8)

Immediate actions

  • Upgrade Crawl4AI to 0.8.0 or later; until then disable the Docker API, block /crawl at the network layer or require authentication
  • Upgrade Budibase beyond 3.31.4 and Cloud CLI / claude-code-ui to 1.25.0 or later
  • Upgrade changedetection.io to 0.54.4 or later and Chamilo LMS to 1.11.36 or later
  • Remove direct internet exposure of Glances, Crawl4AI, Budibase, changedetection.io and ClaudecodeUI management interfaces
  • Hunt web and reverse-proxy logs for the request patterns listed in the IOCs

Workarounds

  • Strip or reject query strings containing /webhooks/trigger at the reverse proxy in front of Budibase
  • Block external access to the Crawl4AI /crawl endpoint
  • Disable file upload via H5P import for Chamilo teacher roles until patched

Longer-term hardening

  • Maintain an inventory of self-hosted open-source tools and subscribe to their GitHub security advisories
  • Place internal developer and automation tools behind SSO or VPN with authentication enforced at the proxy
  • Run exposed services as unprivileged users in containers with egress filtering to limit SSRF and RCE impact
  • Rotate secrets (JWT keys, Flask secret keys, database credentials) on any instance that was reachable while vulnerable

CVEs associated with ProjectDiscovery Neo disclosure

Weaknesses (CWE) in ProjectDiscovery Neo disclosure

CWE-94, CWE-78, CWE-74

Timeline of ProjectDiscovery Neo disclosure

  • GitHub advisory GHSA-5882-5rx9-xgxp for Crawl4AI hooks RCE published, crediting Neo at ProjectDiscovery
  • CVE-2026-26216 published in NVD (CVSS 10.0); Crawl4AI 0.8.0 removes __import__ from builtins and disables hooks by default
  • changedetection.io advisories for CVE-2026-29039 (XPath file read) and CVE-2026-29065 (Zip Slip) published; fixed in 0.54.4
  • CVE-2026-31816 (Budibase auth bypass, CVSS 9.1) and CVE-2026-31861 (claude-code-ui git-config injection) published
  • CVE-2026-31975 (Cloud CLI / ClaudecodeUI WebSocket RCE, CVSS 9.8) published; fixed in 1.25.0
  • CVE-2026-30875 (Chamilo LMS H5P import RCE, CVSS 8.8) published; fixed in 1.11.36
  • ProjectDiscovery publishes research describing 22 CVEs across 13 open-source projects found and validated by Neo; additional findings remain in disclosure

Sources cited for ProjectDiscovery Neo disclosure

Detection coverage for TL-2026-4871

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4871 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
12 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats