CVE-2026-119120 Details
Description
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
A vulnerability exists in Crawl4AI versions 0.9.0 prior to 0.9.5, where the application fails to properly validate the model_name field in the CosineStrategy extraction strategy within untrusted Docker API request bodies. This oversight allows authenticated clients to specify which Hugging Face model the server loads. Exploitation of this vulnerability could involve referencing a malicious repository containing a pickle weight file, which could execute arbitrary Python code on the server under PyTorch versions prior to 2.6. Alternatively, the vulnerability could be used to exhaust the server's disk space and memory resources.
Upgrade Crawl4AI to version 0.9.5 or later, where this vulnerability has been addressed. If an immediate upgrade is not possible, models can be pre-loaded into the Hugging Face cache and the HF_HUB_OFFLINE environment variable set to 1, or the default Crawl4AI image used if cosine extraction is not needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-untrusted-model-loading-via-cosinestrategy-model-name | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| unclecode Crawl4AI | >= 0.9.0, <= 0.9.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |