Live › vulnerability › CVE-2026-119120
Crawl4AI versions from 0.9.0 before 0.9.5 do not filter the CosineStrategy model_name field in untrusted Docker API request bodies. An authenticated client can make the server load an arbitrary HuggingFace model, and a malicious repository with a pickle weight file can run Python code under PyTorch below 2.6, or exhaust disk and memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running the Crawl4AI Docker API from 0.9.0 up to but not including 0.9.5, especially where API clients are authenticated but not fully trusted. The risk is greater where PyTorch is below 2.6, since pickle weights can execute code on load. Deployments that do not expose the Docker API or that run the pinned model only can skip it.
No product ranges from the sources yet.
pip show crawl4ai or the image tag of the Docker deployment.python -c "import torch; print(torch.__version__)".0.9.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-119120")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.