Critical Vulnerability in Crawl4AI Package: Sandbox Escape and RCE
A critical vulnerability has been confirmed in the Crawl4AI Python package, affecting unspecified versions. The vulnerability allows attackers to escape the sandbox and execute arbitrary code, potentially leading to remote code execution.
What happened
The vulnerability resides in the `_safe_eval_expression()` function within the computed fields feature of Crawl4AI. The AST validator used in this function inadequately blocks attributes, enabling a complete sandbox escape. This allows an attacker to execute arbitrary system commands, read and write files, and potentially exfiltrate sensitive information.
Multiple GitHub Security Advisories (GHSA-2jq4-q6vv-4cp3, GHSA-365w-hqf6-vxfg, GHSA-qxjp-w3pj-48m7, GHSA-r253-r9jw-qg44) have confirmed this issue. The advisories detail various attack vectors, including arbitrary file writes, Docker API vulnerabilities, and unauthenticated remote code execution.
To mitigate this threat, it is recommended to upgrade to the latest patched version of the crawl4ai package. Additionally, enabling JWT authentication via the `CRAWL4AI_API_TOKEN` environment variable is advised. For detailed information and specific version details, consult the primary sources listed in the GitHub Security Advisories.
How 0Day mitigates this
crawl4ai is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.