CVE-2026-53753: Crawl4AI Sandbox Escape via Computed Fields AST Validator (Code Injection)
CVE-2026-53753 affects Crawl4AI versions before 0.8.7, where the computed fields expression evaluator can be bypassed because its AST validator only blocks attributes starting with an underscore. According to the record, this allows a sandbox escape leading to arbitrary code execution, reachable without authentication via POST /crawl when JWT is disabled, which is the default. The record states the issue is fixed in 0.8.7, and CVSS 3.1 scores of 10 (NVD) and 9.8 (GitHub) are listed.
Overview
Crawl4AI is an open-source, LLM-oriented web crawler and scraper. According to the record, its computed fields feature evaluates expressions through a function named _safe_eval_expression(), which relies on an AST validator. That validator blocks only attributes whose names begin with an underscore, so attributes of Python generator and frame objects that do not start with an underscore can still be reached. The record classifies the weakness as CWE-94 (Code Injection).
Impact
The record describes a complete sandbox escape that leads to arbitrary code execution. The NVD CVSS 3.1 vector listed is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with a base score of 10. GitHub's CVSS 3.1 score in the record is 9.8. Both scores describe network exploitation without privileges or user interaction, with high confidentiality, integrity and availability impact.
Affected products and versions
- Product listed: Kidocode Crawl4ai
- Affected range listed: versions before 0.8.7 (< 0.8.7)
The record does not give further detail on intermediate builds or on the configuration needed beyond the default JWT state described below.
Exploitation status
The KEV catalog entry in the record is marked as not listed. No confirmed exploitation appears in the sources consulted for this record. The record does not provide EPSS data.
Remediation and mitigation
- Upgrade Crawl4AI to version 0.8.7 or later, which the record identifies as the fixed version.
- Review the advisory referenced by the record for the vendor's mitigation guidance: GitHub Security Advisory GHSA-qxjp-w3pj-48m7.
- Restrict network access to the Crawl4AI service so that only trusted clients can reach it, especially where JWT authentication is disabled.
- Enable and enforce JWT authentication where the deployment allows it, since the record notes that JWT is disabled by default.
Detection guidance
- Inventory all Crawl4AI installations and record their versions to identify any instance below 0.8.7.
- Monitor access logs for unexpected requests to the POST /crawl endpoint, particularly from unknown sources or with unusually complex extraction schemas.
- Watch for unexpected child processes or outbound connections originating from the Crawl4AI service process.
Limitations of the available information
The record does not describe the exact exploit conditions beyond the summary, does not list proof-of-concept availability, and does not provide an EPSS score or SSVC data. The record's title field is empty, so the title used here is derived from the description. Whether the NVD and GitHub scores differ for a documented reason is not stated in the record.
Frequently asked questions
What is CVE-2026-53753?
It is a code injection weakness in Crawl4AI before version 0.8.7, where the computed fields AST validator can be bypassed to achieve arbitrary code execution, according to the record.
Which version fixes it?
The record identifies version 0.8.7 as the fixed version and lists the affected range as versions before 0.8.7.
Is it being actively exploited?
The KEV entry is not listed, and no confirmed exploitation appears in the sources consulted for this record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.