| Package | Affected versions | Patched versions |
|---|---|---|
| crawl4ai | < 0.8.7 | 0.8.7 |
| crawl4ai | < 0.8.7 | 0.8.7 |
The _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution.
The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema.
An attacker sends a POST /crawl request with a JsonCssExtractionStrategy schema containing a malicious computed field expression that:
gi_framef_backf_builtins containing the real __import__os and executes arbitrary commandsUnauthenticated remote code execution inside the Docker container. An attacker can execute arbitrary system commands, read/write files, and exfiltrate secrets.
eval() from computed field expression path entirely -- expressions now log a warning and return default value_safe_eval_expression() function and _SAFE_EVAL_BUILTINS (dead security-sensitive code)function key with Python callables still works for SDK userseval() in /config/dump with JSON-based input validated by Pydantic__builtins__, __loader__, __spec__ from injected modules; removed getattr, setattr, type, __build_class__ from allowed builtinsCRAWL4AI_API_TOKEN environment variableRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free__builtins__