The vulnerability resides in the /crawl endpoint of Crawl4AI deployments built with versions before 0.8.0. The endpoint accepts a hooks parameter that is evaluated using Python's exec(). The allowed built‑in functions include __import__, enabling an unauthenticated attacker to import any module and execute arbitrary system commands. This flaw is classified as code injection (CWE‑94) and can lead to full server compromise, including reading and writing files, exfiltrating sensitive data, and lateral movement across internal networks.

Products from unclecode, the Crawl4AI software, are affected whenever the deployed version is older than 0.8.0. No specific patch version other than 0.8.0 or later provides a fix, and the issue has been acknowledged by the vendor.

The CVSS score of 10.0 indicates maximum severity. The EPSS score is reported as less than 1 %, implying a very low likelihood of a widespread exploit at this time, yet the attack vector is open to anyone who can reach the Docker API. The vulnerability is not currently listed in CISA’s KEV catalog. Successful exploitation requires no authentication, thus the risk to exposed installations is high.