CVE-2026-53753 is a code injection flaw (CWE-94) in Crawl4AI before 0.8.7, scored 9.8 critical. An incomplete expression validator allows a sandbox escape, and the API needs no authentication by default. Upgrade to 0.8.7, enable JWT authentication, and keep the API off public networks.
What's affected
Crawl4AI, installed from pip, in versions up to and including 0.8.6. The patched version is 0.8.7.
The flaw sits in the computed fields feature of extraction schemas, reachable through the /crawl endpoint of the Docker API. The advisory says JWT authentication is disabled by default, so a default deployment accepts unauthenticated requests.
Using Crawl4AI as a Python library with only your own schemas is a lower risk than running the server where others can send requests.
How to check if you're exposed
Read the installed version:
pip show crawl4ai
docker exec <container> pip show crawl4ai
If it is 0.8.6 or lower, you are affected. Then check whether the API server is reachable: which port is published, and whether the container sits behind a reverse proxy that requires a login. Also check whether the CRAWL4AI_API_TOKEN variable is set, since the advisory names it as the way to turn on JWT authentication.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find Crawl4AI instances, including containers started for experiments and agent tooling.
- Upgrade to 0.8.7 and rebuild your Docker image from the new release.
- Set
CRAWL4AI_API_TOKENto enable JWT authentication, as the advisory advises. - Restrict network access to the API so that only trusted callers can reach it.
- Treat secrets that were available inside an exposed container as potentially read, and rotate them.
- Review container logs for unexpected requests to the crawl endpoint.
Why it matters
The computed fields feature evaluates expressions that come with an extraction schema. The advisory says the validator blocked only attributes whose names start with an underscore, and other Python object attributes remained reachable, which allowed a full escape from the intended sandbox. This is CWE-94, code injection, and CWE-913, improper control of dynamically managed code resources.
Blocklists for dynamic code evaluation tend to fail because a language has more ways to reach an object than the list's author thought of. The fix removes eval() from this path entirely and hardens a related hook sandbox, which is the sounder approach.
The impact stated in the advisory is code execution inside the container with the ability to read and write files and reach secrets. The record does not report exploitation, and the CVE is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does JWT authentication fully fix this?
The advisory lists it as a workaround. The patch is the real fix.
Am I affected if I use only the Python library?
The advisory describes the API route. Upgrade anyway, since the library contains the same code.
Sources
Last reviewed: 19 October 2026.
