A critical remote code execution flaw in Crawl4AI’s Docker deployment gives unauthenticated attackers a direct path into containerized systems. The vulnerability, tracked as GHSA-5882-5RX9-XGXP, carries a maximum CVSS score of 10.0. Attackers exploit the `/crawl` API endpoint by sending a malicious JSON payload to the hooks parameter, bypassing a flawed Python sandbox.

The vulnerability stems from a dangerous implementation where the developers used `exec()` to run user-provided code but accidentally allowed the `__import__` function. This oversight lets attackers import malicious modules and execute arbitrary commands. Since the container often runs as root, the impact is severe, potentially enabling theft of API keys or lateral network movement.

Crawl4AI fixed the issue in version 0.8.0. System administrators must immediately upgrade their Docker images and avoid exposing the API to untrusted networks. Running containers with a non-root user and placing a reverse proxy with authentication in front of the endpoint are critical mitigation steps. The exploit is publicly documented, increasing urgency for patches.