critical9.8
CVE-2026-53753
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Impact
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | crawl4ai | <= 0.8.6 | 0.8.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kidocode | Crawl4ai | before 0.8.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-qxjp-w3pj-48m7
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qxjp-w3pj-48m7
- https://github.com/unclecode/crawl4ai/pull/1855
- https://github.com/unclecode/crawl4ai/pull/1886
- https://nvd.nist.gov/vuln/detail/CVE-2026-53753
- https://github.com/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-319.yaml
- https://github.com/unclecode/crawl4ai
- https://pypi.org/project/crawl4ai