python · crawl4aiCritical
crawl4ai: Sandbox Escape in _safe_eval_expression() Leads to RCE
The `_safe_eval_expression()` function in computed fields allowed sandbox escape via generator/frame attributes, leading to unauthenticated RCE.
What changed
The `_safe_eval_expression()` function in computed fields allowed sandbox escape via generator/frame attributes, leading to unauthenticated RCE. Fix removes eval from computed fields, deletes the unsafe function, and hardens hook_manager sandbox.
Who it affects
All users of crawl4ai, especially those running the Docker container with default JWT disabled.
What to do today
Upgrade to the patched version immediately. If upgrade is not possible, enable JWT authentication via CRAWL4AI_API_TOKEN and restrict network access to the Docker API.
The trail
Collected→
Audited→
Written→
Published