Loading vulnerability…
CVE-2026-53753 is a critical remote code execution vulnerability in Crawl4AI affecting versions prior to 0.8.7. The flaw is in the computed fields feature, specifically the _safe_eval_expression() function, which uses an AST-based validator that blocks only attribute names beginning with an underscore. Because Python generator and frame attributes such as gi_frame, f_back, and f_builtins do not begin with an underscore, an attacker can traverse these objects to escape the intended sandbox. By submitting a crafted extraction schema to the POST /crawl endpoint, a remote attacker can reach arbitrary Python builtins and execute attacker-controlled code. The issue is pre-authentication in default deployments because JWT authentication is disabled by default.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository is a small standalone Python proof-of-concept exploit for CVE-2026-53753 affecting Crawl4AI <= 0.8.6. Structure is minimal: LICENSE, README.md with vulnerability explanation and usage, and exploit.py containing the working exploit. The exploit targets the Crawl4AI /crawl API by sending a JSON body that defines a JsonCssExtractionStrategy with a computed field expression. That expression abuses insufficient AST validation to create a generator, access gi_frame and f_back, walk stack frames until f_builtins is found, recover __import__, import os, and execute an attacker-controlled shell command through os.popen().read(). The command output is then extracted from the JSON response and printed locally. The code disables TLS certificate verification, normalizes the target into an HTTPS URL ending in /crawl, and supports a user-supplied crawler URL and shell command. README also documents a /health endpoint for version-based detection and notes that upgrading to 0.8.7 or later fixes the issue. Overall, this is a real pre-auth remote code execution exploit with a basic but functional hardcoded payload delivery mechanism.
Repository is a focused PoC for CVE-2026-53753, an unauthenticated RCE in Crawl4AI <= 0.8.6. The main exploit is exploit.py, a standalone Python script that builds a malicious JSON request and POSTs it to the target's /crawl API. The exploit abuses Crawl4AI's computed-field expression evaluator in JsonCssExtractionStrategy: a crafted Python expression uses a running generator's gi_frame and f_back chain to reach a caller frame's real f_builtins, retrieves __import__ via dictionary subscript, imports os, and executes an arbitrary shell command with popen(...).read(). The command output is returned in-band in the JSON response, making exploitation directly observable. Repository structure is small and coherent: exploit.py contains the actual exploit logic and CLI; README.md documents vulnerability details, exploitation steps, impact, and remediation; ANALYSIS.md provides a deep code-level explanation of the AST sandbox escape and frame traversal; EVIDENCE.txt contains a successful end-to-end run against the official vulnerable Docker image; lab/docker-compose.yml provides a reproducible vulnerable lab using unclecode/crawl4ai:0.8.6 on port 11235. This is not a framework module and not merely a detector; it is a working operational PoC with customizable command execution against a network-exposed target.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.