CVE-2026-53753Critical· 9.8▾ AbyssalPoC availableCrawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 2.9%
2 GitHub repos · Nuclei ×1
The _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution.
The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.
An attacker sends a POST /crawl request with a JsonCssExtractionStrategy schema containing a malicious computed field expression that:
gi_framef_backf_builtins containing the real __import__os and executes arbitrary commandsUnauthenticated remote code execution inside the Docker container. An attacker can execute arbitrary system commands, read/write files, and exfiltrate secrets.
eval() from computed field expression path entirely -- expressions now log a warning and return default value_safe_eval_expression() function and _SAFE_EVAL_BUILTINS (dead security-sensitive code)function key with Python callables still works for SDK userseval() in /config/dump with JSON-based input validated by Pydantic__builtins__, __loader__, __spec__ from injected modules; removed getattr, setattr, type, __build_class__ from allowed builtinsCRAWL4AI_API_TOKEN environment variable__builtins__ escape and hardcoded JWT secret bypasscrawl4ai <= 0.8.6Upgrade to a patched release:
crawl4ai 0.8.7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56266Critical· 9.8Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
GHSA-r253-r9jw-qg44Critical· 10.0Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args
CVE-2026-56265Critical· 9.8Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server
CVE-2026-53755High· 8.6Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
CVE-2026-91940High· 7.5crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields
CVE-2026-91942Medium· 5.4crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML