CVE-2026-53753

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Published Jun 23, 2026 CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed

Description

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.

Analysis

Technical impact

Crawl4AI is an open‑source LLM‑friendly web crawler and scraper. Prior to version 0.8.7, its _safe_eval_expression() function in computed fields only blocked attributes starting with an underscore. Python’s generator and frame object attributes (gi_frame, f_back, f_builtins) do not start with an underscore, permitting a complete AST sandbox escape that enables arbitrary code execution. The flaw is triggered via a POST to /crawl with a crafted extraction schema and requires no authentication because the JWT feature is disabled by default. If exploited, an attacker can execute any command on the host running Crawl4AI, resulting in total compromise of confidentiality, integrity, and availability.

Affected Systems

Any installation of Crawl4AI older than version 0.8.7 is affected. The product, provided by unclecode, was released before the 0.8.7 update that addressed the sandbox escape. The vulnerability is exploited when Crawl4AI is exposed.

Risk and Exploitability

With a CVSS score of 9.8, this vulnerability is considered critical. The EPSS score is 2%, indicating a low but non-zero likelihood of exploitation. The lack of authentication and the straightforward POST interface suggest that the vulnerability is not yet listed in the CISA KEV catalog, yet the severity and access conditions imply that it should receive immediate attention. The attack vector is clear: a malicious requester can send a specially crafted POST payload to /crawl and gain code execution on the host running Crawl4AI.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

unclecode

crawl4ai

affected

Version	Status	Constraints
`< 0.8.7`	affected	—

Configuration 1 [-]

cpe:2.3:a:kidocode:crawl4ai:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Unclecode

Crawl4ai

Version	Status	Scheme	Platform
`[0,0.8.7)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Crawl4AI to 0.8.7 or later, which applies the fix for CWE‑913 (arbitrary code execution) and CWE‑94 (input validation).
If an upgrade is not immediately possible, restrict access to the /crawl endpoint to authorized users only, employing firewall rules or network segmentation to limit exposure.
Enable and enforce JWT authentication to require clients to present a valid token before the API accepts POST requests, thereby reducing the risk profile associated with CWE‑913.

Generated by OpenCVE AI on August 22, 2026 at 10:51 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-qxjp-w3pj-48m7	Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.4% (2.430% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qxjp-w3pj-48m7

History

Jun 23, 2026 10:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Unclecode Unclecode crawl4ai
Vendors & Products		Unclecode Unclecode crawl4ai

Jun 23, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
Title		Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Weaknesses		CWE-913 CWE-94
References		https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qxjp-w3pj-48m7
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`