Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 0.6%
from disclosure to weapon6 days
Published on NVDJun 23
1st PoC+6d
exploitation probability
0.6%top 54% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
unclecode · crawl4aipublic PoCs found — 3
githubgithub.com/0xEnc0der/CVE-2026-53753★ 0githubgithub.com/thecodeb0ss/Advanced-CVE-2026-53753★ 0githubgithub.com/BiiTts/CVE-2026-53753-Crawl4AI-RCE★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.