CVE-2026-26216 is a critical remote code execution vulnerability in unclecode's Crawl4AI product affecting versions prior to 0.8.0. The vulnerability arises because the /crawl endpoint accepts a hooks parameter containing Python code executed with exec(). The inclusion of the __import__ builtin in the allowed builtins enables unauthenticated remote attackers to import arbitrary modules and execute system commands. Exploitation can lead to complete server compromise, including arbitrary command execution, file read/write, sensitive data theft, and lateral movement within internal networks.

Successful exploitation results in full server compromise with arbitrary command execution, file system read and write capabilities, exfiltration of sensitive data, and potential lateral movement within internal networks. The vulnerability requires no authentication and has a network attack vector, making it highly severe.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid exposing the vulnerable /crawl endpoint to untrusted networks and restrict access to trusted users only. Consider disabling or restricting the hooks parameter functionality if possible.