Loading vulnerability…
Unauthenticated RCE in Crawl4AI Computed Fields
CVE-2026-53753 is a critical remote code execution vulnerability in Crawl4AI affecting versions prior to 0.8.7. The flaw is in the computed fields feature, specifically the _safe_eval_expression() function, which relies on an AST validator that blocks only attribute names beginning with an underscore. Because Python generator and frame attributes such as gi_frame, f_back, and f_builtins do not begin with an underscore, an attacker can traverse execution frames, reach Python builtins, escape the intended expression sandbox, and execute arbitrary code. The vulnerable path is reachable through crafted extraction schemas submitted to the POST /crawl endpoint. In default deployments where JWT authentication is disabled, exploitation does not require authentication.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution in the Crawl4AI runtime context, including command execution within the containerized service environment. This can lead to full compromise of the application instance, exposure of sensitive data and secrets available to the process, unauthorized file read and write operations, integrity loss through arbitrary modification of application state or data, and service disruption. The reported CVSS 3.1 characteristics indicate network-reachable exploitation with no privileges required and high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, enable JWT authentication by configuring the API token mechanism and restrict network exposure of the Crawl4AI API so that the /crawl endpoint is not reachable by untrusted users. Limit access to trusted internal clients only, isolate the service in a constrained runtime environment, and monitor for suspicious use of computed field expressions until the patched release can be deployed.
Patch, then assume compromise.
Upgrade Crawl4AI to version 0.8.7 or later. The fix removes eval() from the computed field expression path, eliminates the unsafe _safe_eval_expression() logic, replaces eval()-based handling in related configuration processing with validated JSON input, and hardens sandboxing behavior by stripping dangerous builtins and module attributes. Review any existing computed field schemas and remove or sanitize untrusted expressions.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.