---
id: CVE-2026-53753
title: >-
  Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in
  Docker API
summary: >-
  Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in
  Docker API
severity: critical
cvss: 9.8
cwe:
  - CWE-94
  - CWE-913
vendor: crawl4ai
product: crawl4ai
ecosystem: pip
affected:
  - crawl4ai <= 0.8.6
patched:
  - crawl4ai 0.8.7
published: '2026-06-16'
updated: '2026-06-16'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-qxjp-w3pj-48m7'
references:
  - url: >-
      https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qxjp-w3pj-48m7
  - url: 'https://github.com/unclecode/crawl4ai/pull/1855'
  - url: 'https://github.com/unclecode/crawl4ai/pull/1886'
  - url: 'https://github.com/advisories/GHSA-qxjp-w3pj-48m7'
tags:
  - ghsa
  - pip
  - exploit-available
epss: 0.029
epssPercentile: 0.86364
ingestedAt: '2026-06-29T14:31:47.703Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/BiiTts/CVE-2026-53753-Crawl4AI-RCE'
    - 'https://github.com/0xEnc0der/CVE-2026-53753'
  nuclei:
    - CVE-2026-53753
  checkedAt: '2026-09-24T07:53:06.677Z'
exploitAvailable: true
---

## Overview

### Summary

The `_safe_eval_expression()` function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (`gi_frame`, `f_back`, `f_builtins`) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution.

The attack requires no authentication (JWT disabled by default) and is triggered via `POST /crawl` with a crafted extraction schema.

### Attack Vector

An attacker sends a `POST /crawl` request with a `JsonCssExtractionStrategy` schema containing a malicious computed field expression that:
1. Creates a generator to access `gi_frame`
2. Walks the frame chain via `f_back`
3. Reaches `f_builtins` containing the real `__import__`
4. Imports `os` and executes arbitrary commands

### Impact

Unauthenticated remote code execution inside the Docker container. An attacker can execute arbitrary system commands, read/write files, and exfiltrate secrets.

### Fix Details

1. Removed `eval()` from computed field expression path entirely -- expressions now log a warning and return default value
2. Deleted `_safe_eval_expression()` function and `_SAFE_EVAL_BUILTINS` (dead security-sensitive code)
3. `function` key with Python callables still works for SDK users
4. Replaced `eval()` in `/config/dump` with JSON-based input validated by Pydantic
5. Fixed hook_manager sandbox: stripped `__builtins__`, `__loader__`, `__spec__` from injected modules; removed `getattr`, `setattr`, `type`, `__build_class__` from allowed builtins

### Workarounds

1. Upgrade to the patched version (recommended)
2. Enable JWT authentication via `CRAWL4AI_API_TOKEN` environment variable
3. Restrict network access to the Docker API

### Credits

- Song Binglin ([q1uf3ng](https://github.com/q1uf3ng)) - reported the AST sandbox escape
- by111 ([August829](https://github.com/August829)) - reported the hook sandbox `__builtins__` escape and hardcoded JWT secret bypass
- [jannahopp](https://github.com/jannahopp) - PR #1855 proposing eval removal
- [ntohidi](https://github.com/ntohidi) - PR #1886 proposing allowlist approach

## Affected packages

- `crawl4ai <= 0.8.6`

## Remediation

Upgrade to a patched release:

- `crawl4ai 0.8.7`