Crawl4AI is an open‑source LLM‑friendly web crawler and scraper. Before version 0.8.7, its _safe_eval_expression() function, used in computed fields, only blocked attributes starting with an underscore. Python’s generator and frame object attributes (gi_frame, f_back, f_builtins) do not start with underscore, permitting a complete AST sandbox escape that enables arbitrary code execution. The flaw is triggered via a POST to /crawl with a crafted extraction schema and requires no authentication because the JWT feature is disabled by default. If exploited, an attacker can execute any command on the host running Crawl4AI, resulting in total compromise of confidentiality, integrity, and availability.

Any installation of Crawl4AI older than version 0.8.7 is affected. The product, provided by unclecode, was released before the 0.8.7 update that addressed the sandbox escape. The vulnerability is exploited when Crawl4AI is exposed.

With a CVSS score of 9.8, this vulnerability is considered critical. No EPSS score is published, but the lack of authentication and the straightforward POST interface suggest a high likelihood of not listed in the CISA KEV catalog, yet the severity and access conditions imply that it should receive immediate attention. The attack vector is clear: a malicious requester can send a specially crafted POST payload to /crawl and gain code execution on the host running Crawl4AI.