PT-2026-53411 · Pypi · Crawl4Ai

Published

2026-06-29

·

Updated

2026-06-29

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

The safe eval expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi frame, f back, f builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution.
The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.

Attack Vector

An attacker sends a POST /crawl request with a JsonCssExtractionStrategy schema containing a malicious computed field expression that:
  1. Creates a generator to access gi frame
  2. Walks the frame chain via f back
  3. Reaches f builtins containing the real import
  4. Imports os and executes arbitrary commands

Impact

Unauthenticated remote code execution inside the Docker container. An attacker can execute arbitrary system commands, read/write files, and exfiltrate secrets.

Fix Details

  1. Removed eval() from computed field expression path entirely -- expressions now log a warning and return default value
  2. Deleted safe eval expression() function and SAFE EVAL BUILTINS (dead security-sensitive code)
  3. function key with Python callables still works for SDK users
  4. Replaced eval() in /config/dump with JSON-based input validated by Pydantic
  5. Fixed hook manager sandbox: stripped builtins, loader, spec from injected modules; removed getattr, setattr, type, build class from allowed builtins

Workarounds

  1. Upgrade to the patched version (recommended)
  2. Enable JWT authentication via CRAWL4AI API TOKEN environment variable
  3. Restrict network access to the Docker API

Credits

  • Song Binglin (q1uf3ng) - reported the AST sandbox escape
  • by111 (August829) - reported the hook sandbox builtins escape and hardcoded JWT secret bypass
  • jannahopp - PR #1855 proposing eval removal
  • ntohidi - PR #1886 proposing allowlist approach

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-319

Affected Products

Crawl4Ai