Critical Crawl4AI Docker API flaws enabled unauthenticated RCE and file abuse

Crawl4AI disclosed critical vulnerabilities in its Docker API server affecting versions 0.8.6 and earlier, including an AST sandbox escape in the computed fields feature that allowed unauthenticated remote code execution through the /crawl endpoint. The flaw let attackers abuse Python generator and frame attributes such as gi_frame, f_back, and f_builtins to reach __import__ and run arbitrary OS commands inside the container. Additional reported weaknesses in the network-exposed API included unsafe code execution controls, server-side request forgery, missing authentication protections, hardcoded credentials, and improper path sanitization affecting endpoints including /screenshot, /pdf, /crawl, and /execute_js.

The project patched the issues in version 0.8.7 by removing eval() from the computed-field execution path, replacing the prior underscore-based attribute blocklist with a stricter allowlist, tightening _safe_eval_config, and removing dangerous built-ins from the hook manager. The update also added path validation to stop traversal-style file writes and introduced adversarial security tests covering the reported exploit chains. Maintainers advised users to upgrade immediately, enable JWT authentication with CRAWL4AI_API_TOKEN, configure secrets securely, restrict network exposure of the Docker API, and disable JavaScript execution where it is not required.