9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53753

CVE-2026-53753: Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53753

CVE-2026-53753:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
crawl4ai	pip	<= 0.8.6	0.8.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the 'computed fields' feature of the JsonCssExtractionStrategy class in crawl4ai. The root cause is the direct use of eval() on untrusted user input provided in a crawl request's extraction schema. The function JsonCssExtractionStrategy._compute_field took a user-provided string from the expression key and executed it using eval(), leading to a straightforward remote code execution vulnerability.

An attempt was made to mitigate this with a sandboxed evaluation function, _safe_eval_expression. However, this sandbox was flawed. It relied on a weak blocklist that only prevented access to attributes starting with an underscore. The exploit bypassed this by using a generator expression to gain access to a gi_frame object. From there, it could traverse the call stack via the f_back attribute on frame objects until it reached the top-level frame and its f_builtins, which contains the original, unrestricted __import__ function. This provided a complete sandbox escape, again leading to RCE. The patches correctly identified both _compute_field and _safe_eval_expression as the vulnerable components, first by removing the dangerous eval() call in _compute_field and subsequently by hardening the _safe_eval_expression sandbox with a strict allowlist approach to prevent frame-walking exploits.

Vulnerable functions

JsonCssExtractionStrategy._compute_field

crawl4ai/extraction_strategy.py

The function directly uses `eval()` on the user-supplied 'expression' field from the extraction schema. This allows an attacker to execute arbitrary Python code on the server by crafting a malicious expression.

_safe_eval_expression

crawl4ai/extraction_strategy.py

This function, intended as a safe alternative to `eval()`, used an insufficient blocklist based on attribute prefixes. It failed to block access to non-prefixed but highly sensitive attributes like a generator's `gi_frame` and a frame's `f_back`. This allowed an attacker to walk the stack frame, access the `f_builtins` dictionary, and call `__import__` to achieve a complete sandbox escape and execute arbitrary code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.