PyPI: crawl4ai
CVE-2026-53753
Safety vulnerability ID: SFTY-20260616-42763
Affected versions of the Crawl4AI package are vulnerable to Remote Code Execution due to inadequate attribute blocking in the AST validator within the `_safe_eval_expression()` function. The function fails to block Python generator and frame object attributes such as `gi_frame`, `f_back`, and `f_builtins`, allowing for a complete sandbox escape. An attacker can exploit this vulnerability by sending a `POST /crawl` request with a crafted `JsonCssExtractionStrategy` schema, enabling the execution of arbitrary system commands within the Docker container without requiring authentication.
Overview
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
Advisory
Crawl4AI – Code Injection
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260616-42763/CVE-2026-53753
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qxjp-w3pj-48m7
- https://github.com/unclecode/crawl4ai/pull/1855
- https://github.com/unclecode/crawl4ai/pull/1886
- https://nvd.nist.gov/vuln/detail/CVE-2026-53753
- https://github.com/advisories/GHSA-qxjp-w3pj-48m7
- https://github.com/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-319.yaml
- https://github.com/unclecode/crawl4ai
- https://pypi.org/project/crawl4ai
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more