CVE-2026-53753

Katalog CVE

CVSS 10.0 · Critical EPSS 2,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada kidocode crawl4ai. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

29 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-913: Improper Control of Dynamically-Managed Code Resources

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-qxjp-w3pj-48m7 advisory pihak ketiga · mitigasi