Ast-Bypass

Crawl4AI JsonCssExtractionStrategy AST Sandbox Escape → Unauthenticated RCE (CVE-2026-53753)

Crawl4AI's JsonCssExtractionStrategy supports "computed fields" — small Python expressions evaluated against each extracted item via safeevalexpression(). That function tries to sandbox the expression with an AST allow-list (rejecting only…