CVE-2026-53753: critical vulnerability in unclecode crawl4ai
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.8epss 2.9%
from disclosure to weapon6 days
Published on NVDJun 23
1st PoC+6d
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
unclecode · crawl4aipublic PoCs found — 3
githubgithub.com/0xEnc0der/CVE-2026-53753★ 0githubgithub.com/thecodeb0ss/Advanced-CVE-2026-53753★ 0githubgithub.com/BiiTts/CVE-2026-53753-Crawl4AI-RCE★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — unclecode crawl4ai
In the same product, most dangerous first.
CVE-2026-53755HIGHCrawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF checkEPSS 1.6%CVE-2026-57572CRITICALCrawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_argsEPSS 0.9%CVE-2026-57571CRITICALCrawl4AI arbitrary file write via download filename path traversalEPSS 0.8%CVE-2026-91941HIGHCrawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategyEPSS 0.5%CVE-2026-91940HIGHcrawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategyEPSS 0.5%CVE-2026-115508HIGHCrawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex FieldsEPSS 0.5%