Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
The _safe_eval_expression() function used in the computed fields mechanism validates AST expressions, blocking only attributes starting with an underscore. Attributes of Python generator and frame objects (gi_frame, f_back, f_builtins) do not start with an underscore, so they are not blocked by the validator. An attacker can craft an extraction schema containing a malicious expression and submit it via a POST request to the /crawl endpoint, which leads to complete sandbox escape and arbitrary code execution on the server. Since JWT is disabled by default, the attack requires no authentication.
An attacker gains the ability to execute arbitrary code on the server with the application process privileges, which may result in complete system compromise, data disclosure, and violation of service integrity and availability.
Crawl4AI should be updated to version 0.8.7 or later, in which the vulnerability has been fixed. As a temporary measure, it is recommended to restrict network access to the POST /crawl endpoint and enable JWT authentication.
Kidocode Crawl4AI in versions before 0.8.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HKidocode Crawl4ai
APPKidocode< 0.8.7
Related vulnerabilities
SSRF w Crawl4AI — brak walidacji adresów webhook w Docker API
Crawl4AI: path traversal umożliwiający zapis dowolnych plików i RCE
Crawl4AI: RCE przez wstrzyknięcie argumentów Chromium w Docker API
Crawl4AI: Dowolne wykonanie JavaScript przez endpoint /execute_js
Crawl4AI: zapis dowolnych plików poza katalogiem przez path traversal i TOCTOU