CVE-2026-53753: Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Summary

The safeevalexpression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (giframe, fback, fbuiltins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution.

The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.

Attack Vector

An attacker sends a POST /crawl request with a JsonCssExtractionStrategy schema containing a malicious computed field expression that: 1. Creates a generator to access giframe 2. Walks the frame chain via fback 3. Reaches fbuiltins containing the real import 4. Imports os and executes arbitrary commands

Impact

Unauthenticated remote code execution inside the Docker container. An attacker can execute arbitrary system commands, read/write files, and exfiltrate secrets.

Fix Details

1. Removed eval() from computed field expression path entirely -- expressions now log a warning and return default value 2. Deleted safeevalexpression() function and SAFEEVALBUILTINS (dead security-sensitive code) 3. function key with Python callables still works for SDK users 4. Replaced eval() in /config/dump with JSON-based input validated by Pydantic 5. Fixed hookmanager sandbox: stripped builtins, loader, spec from injected modules; removed getattr, setattr, type, buildclass from allowed builtins

Workarounds

1. Upgrade to the patched version (recommended) 2. Enable JWT authentication via CRAWL4AIAPITOKEN environment variable 3. Restrict network access to the Docker API

Credits

- Song Binglin (q1uf3ng) - reported the AST sandbox escape - by111 (August829) - reported the hook sandbox builtins escape and hardcoded JWT secret bypass - jannahopp - PR #1855 proposing eval removal - ntohidi - PR #1886 proposing allowlist approach