CVE-2026-26216 is a critical remote code execution vulnerability in Crawl4AI before version 0.8.0. The vulnerability arises because the /crawl endpoint accepts a hooks parameter containing Python code executed with exec(), and the __import__ builtin is included in the allowed builtins. This improper control of code generation (CWE-94) allows unauthenticated attackers to import arbitrary modules and execute system commands remotely. Exploitation can lead to full server compromise, including arbitrary command execution, file read/write access, sensitive data exfiltration, and lateral movement within internal networks.

Successful exploitation allows unauthenticated remote attackers to achieve full server compromise. This includes arbitrary command execution on the host, reading and writing files, exfiltrating sensitive data, and moving laterally within internal networks. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid exposing the vulnerable /crawl endpoint to untrusted networks or unauthenticated users. Consider disabling or restricting the use of the hooks parameter if possible to prevent execution of arbitrary code.