# ProjectDiscovery Neo disclosure: 22 CVEs across 13 open-source projects (incl. Crawl4AI CVE-2026-26216 unauthenticated RCE, CVSS 9.8-10.0)

> ProjectDiscovery reports that its Neo AI security agent discovered and validated, with working exploits, 22 CVEs across 13 open-source projects including NocoDB, Crawl4AI, Gitea, SiYuan, Glances, changedetection.io, Budibase, Checkmate, ClaudecodeUI (Cloud CLI), Faraday, Chamilo LMS, AVideo and beautiful-mermaid. Several are network-reachable and unauthenticated (Crawl4AI RCE, Budibase auth bypass, ClaudecodeUI WebSocket RCE). None of the sources state in-the-wild exploitation.

- **Published:** 2026-10-31T01:52:43Z
- **Last reviewed:** 2026-10-31T01:52:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4871
- **ID:** TL-2026-4871
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28357, CVE-2026-28359, CVE-2026-26216, CVE-2026-26217, CVE-2026-25946, CVE-2026-32110, CVE-2026-30930, CVE-2026-30928, CVE-2026-32596, CVE-2026-27645, CVE-2026-29038, CVE-2026-29039, CVE-2026-29065, CVE-2026-31816, CVE-2026-31836, CVE-2026-30829, CVE-2026-31975, CVE-2026-31861, CVE-2026-25765, CVE-2026-30875, CVE-2026-30885, CVE-2026-26226

## Description

On 2026-03-20 ProjectDiscovery (authors Andy Cao and Prince Chaddha) published research describing 22 vulnerabilities found by its Neo agent, which indexes a codebase, maps authentication boundaries, deploys the application in an isolated sandbox and produces proof-of-concept exploits verified with OAST callbacks or file-read confirmation. ProjectDiscovery states a roughly 10-20% false-positive rate and that all 22 CVEs were reported to the maintainers, most of them patched, with further findings still in disclosure.

The highest-impact issues are network-reachable. CVE-2026-26216 (Crawl4AI < 0.8.0, CWE-94): the Docker API /crawl endpoint accepts a 'hooks' parameter containing Python executed through exec(); because __import__ was left in the allowed builtins, an unauthenticated attacker can import os/subprocess/socket and run arbitrary commands. NVD scores it 10.0 (CVSS 3.1 and 4.0); the harness hunt skeleton cites 9.8. A public PoC appears in GHSA-5882-5rx9-xgxp. CVE-2026-26217 is a companion LFI via file:// URLs. CVE-2026-31816 (Budibase <= 3.31.4, CVSS 9.1): an unanchored regex tests ctx.request.url, so appending ?/webhooks/trigger to any endpoint bypasses JWT validation; ProjectDiscovery chained it to user enumeration, privilege escalation to admin via PATCH /api/global/users and mapping of internal Docker services (CouchDB on 5984). CVE-2026-31975 (ClaudecodeUI / Cloud CLI < 1.25.0, CVSS 9.8, CWE-78): a chain of a hardcoded fallback JWT secret, a platform-mode authentication path that assigns a generic platform-user identity, and a WebSocket shell handler that does not re-validate per message, resulting in unauthenticated shell access. CVE-2026-31861 (@siteboon/claude-code-ui <= 1.23.0) is a shell injection in /api/user/git-config via backticks or $() in gitName/gitEmail.

changedetection.io (<= 0.54.3, fixed 0.54.4) has CVE-2026-29039, where XPath 3.0 unparsed-text() reads arbitrary files through the include_filters field, and CVE-2026-29065, a Zip Slip via zipfile.extractall() allowing arbitrary file overwrite (the article describes an unauthenticated /import endpoint and overwriting an imported Python module for RCE; the GitHub advisory describes backup restore overwriting files such as the Flask secret key). The GitHub advisories rate both 8.8 High, while the article labels them Critical. CVE-2026-30875 (Chamilo LMS < 1.11.36, CVSS 8.8) lets an authenticated teacher upload a webshell via H5P import because only h5p.json presence is checked and .htaccess or alternate-extension PHP files are not blocked. The remaining CVEs are medium or high issues: stored and reflected XSS (NocoDB, changedetection.io, beautiful-mermaid), SSRF (Gitea OpenID discovery, SiYuan, Faraday), Glances SQL injection, unauthenticated config exposure and REST API access, Checkmate mass-assignment privilege escalation and unauthenticated status page access, and an unauthenticated IDOR in AVideo. Per-CVE severities beyond the NVD-verified ones are as labelled in the article.

Defenders should inventory these projects (many are self-hosted internal tools), upgrade to the fixed versions listed in each advisory, and restrict network exposure of management and API surfaces. No threat actor, C2 infrastructure or network IOCs are reported; the indicators below are exploit artifacts (endpoints, payload strings, filenames, package names) useful for log hunting.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.006 Python
- T1059.004 Unix Shell
- T1059.007 JavaScript
- T1505.003 Web Shell
- T1098 Account Manipulation
- T1552.001 Credentials In Files
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1005 Data from Local System

## Sources

- [Everyone is finding vulns. The hard part is proving them. (ProjectDiscovery)](https://projectdiscovery.io/blog/everyone-is-finding-vulns-the-hard-part-is-proving-them)
- [GHSA-5882-5rx9-xgxp Crawl4AI Docker API RCE via hooks](https://github.com/unclecode/crawl4ai/security/advisories/GHSA-5882-5rx9-xgxp)
- [NVD CVE-2026-26216 (Crawl4AI)](https://nvd.nist.gov/vuln/detail/CVE-2026-26216)
- [VulnCheck: Crawl4AI Docker API unauthenticated RCE via hooks parameter](https://www.vulncheck.com/advisories/crawl4ai-docker-api-unauthenticated-remote-code-execution-via-hooks-parameter)
- [Crawl4AI v0.8.0 release notes](https://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md)
- [NVD CVE-2026-31816 (Budibase auth bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-31816)
- [GHSA-gw94-hprh-4wj8 Budibase authentication bypass](https://github.com/Budibase/budibase/security/advisories/GHSA-gw94-hprh-4wj8)
- [NVD CVE-2026-31975 (Cloud CLI / ClaudecodeUI)](https://nvd.nist.gov/vuln/detail/CVE-2026-31975)
- [GHSA-gv8f-wpm2-m5wr Cloud CLI WebSocket shell command injection](https://github.com/advisories/GHSA-gv8f-wpm2-m5wr)
- [GHSA-7fv4-fmmc-86g2 claude-code-ui git-config shell injection](https://github.com/advisories/GHSA-7fv4-fmmc-86g2)
- [GHSA-6fmw-82m7-jq6p changedetection.io XPath unparsed-text file read](https://github.com/advisories/GHSA-6fmw-82m7-jq6p)
- [GHSA-25g8-2mcf-fcx9 changedetection.io Zip Slip](https://github.com/advisories/GHSA-25g8-2mcf-fcx9)
- [NVD CVE-2026-30875 (Chamilo LMS H5P import RCE)](https://nvd.nist.gov/vuln/detail/CVE-2026-30875)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4871