Open-source LLM Friendly Web Crawler Vulnerability in Crawl4AI
CVE-2026-53753
Key Information:
Badges
What is CVE-2026-53753?
Crawl4AI, an open-source LLM-friendly web crawler, prior to version 0.8.7, contains a critical vulnerability in its computed fields feature. The _safe_eval_expression() function employs an AST validator that inadequately restricts attribute access, allowing attributes without an underscore prefix to execute arbitrary code. This enables attackers to escape the intended sandbox environment and execute malicious commands, potentially compromising the integrity of the system. The vulnerability can be exploited without authentication, as JWT is disabled by default, making it accessible through a crafted POST request to /crawl. The issue was resolved in version 0.8.7.
Affected Version(s)
crawl4ai < 0.8.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.