CVE-2026-53753 – Pre-Auth RCE via AST Sandbox Escape – Crawl4AI prior to 0.8.7

Summary

CVE-2026-53753 is a critical, pre-authentication Remote Code Execution (RCE) vulnerability in Crawl4AI, an open-source LLM-friendly web crawler and scraper, affecting all versions prior to 0.8.7. The flaw resides in the computed fields feature’s _safe_eval_expression() function, where an incomplete AST-based sandbox validator can be bypassed using Python generator and frame object attributes, enabling full arbitrary code execution on the host server. With a CVSS v3.1 score of 9.8 (Critical) and no authentication required by default, internet-exposed Crawl4AI Docker API servers are at immediate risk of complete compromise.

Technical details

• Root cause: The _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attribute accesses beginning with an underscore character. Python’s generator and frame object attributes — gi_frame, f_back, and f_builtins — do not begin with an underscore and therefore pass validation unchallenged.
• Exploit chain: An attacker crafts an expression that accesses a generator’s frame via gi_frame, traverses the call stack using f_back, and reaches f_builtins to obtain a reference to the real __import__ built-in function, achieving a complete sandbox escape and arbitrary system command execution.
• Trigger conditions: The vulnerability is triggered by a single HTTP POST /crawl request containing a malicious extraction schema — no prior access, credentials, or user interaction are required.
• Authentication: JWT authentication is disabled by default in affected versions, making the attack entirely unauthenticated.
• Attack vector: Network-accessible HTTP API (Crawl4AI Docker API server, default port 11235).
• Impact: Full unauthenticated remote code execution within the Docker container, enabling command execution, arbitrary file access, and credential/secret exfiltration.
• CWEs: CWE-94 (Improper Control of Generation of Code), CWE-913 (Improper Control of Dynamically-Managed Code Resources).
• Fix applied in 0.8.7: The patched version removes eval() entirely from the computed fields expression path and replaces it with JSON-based validation; the hook manager sandbox was additionally hardened by stripping dangerous built-ins.

Affected software

• Crawl4AI all versions up to and including 0.8.6 (i.e., prior to 0.8.7)

Severity

• CVSS v3.1 Base Score: 9.8 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate – Patch: Upgrade Crawl4AI to version 0.8.7 or later, which removes the vulnerable eval()-based expression path entirely.
• If immediate patching is not possible:
  • Restrict network access to the Crawl4AI API server (default port 11235) using firewall rules or network-level controls so that it is not reachable from untrusted networks.
  • Enable JWT authentication explicitly in the server configuration to require valid tokens for all API requests.
  • Consider taking the Crawl4AI Docker service offline until the patch can be applied, given the severity and ease of exploitation.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-53753 at NIST
• GitLab Advisory – CVE-2026-53753
• GitHub Security Advisory GHSA-qxjp-w3pj-48m7