CVE-2026-26216

The /crawl endpoint accepts a hooks parameter containing Python code, which is then executed using the exec() function. Among the allowed built-in functions (builtins) was __import__, which enabled dynamic importing of arbitrary Python modules. This allowed an unauthenticated attacker to import system modules (e.g., os, subprocess) and execute arbitrary commands on the server using them. The attack requires no authentication or user interaction.

Successful exploitation allows an attacker to achieve complete server takeover, including arbitrary system command execution, file read and write operations, sensitive data exfiltration, and lateral movement within internal networks.

Crawl4AI should be updated to version 0.8.0 or newer, in which the vulnerability has been removed. Details regarding the fix are available in the v0.8.0 release notes and in the security advisory GHSA-5882-5rx9-xgxp on GitHub. Until the patch is deployed, consider disabling public access to the /crawl endpoint or implementing firewall rules that restrict access only to trusted IP addresses.

Kidocode Crawl4AI in versions earlier than 0.8.0, deployed via Docker API