{"id":"CVE-2026-119120","kind":"vulnerability","aliases":["CVE-2026-119120"],"related":[],"title":"Crawl4AI: Docker API lets authenticated clients load malicious model, run code","description":"Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.","summary":"Crawl4AI versions from 0.9.0 before 0.9.5 do not filter the CosineStrategy model_name field in untrusted Docker API request bodies. An authenticated client can make the server load an arbitrary HuggingFace model, and a malicious repository with a pickle weight file can run Python code under PyTorch below 2.6, or exhaust disk and memory.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","crawl4ai","docker","python","pytorch","self-hosted"],"not_affected_if":["library-only-use","pytorch-2.6-or-later"],"how_to_check":"- Check the installed Crawl4AI version, for example with `pip show crawl4ai` or the image tag of the Docker deployment.\n- Check whether the Docker API is reachable by clients outside the team.\n- Check the PyTorch version in the server image, for example with `python -c \"import torch; print(torch.__version__)\"`.","fix":"- Crawl4AI: move to `0.9.5` or later.","status":"open","published_at":"2026-10-29T16:18:04+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:40+00:00","updated_at":"2026-10-29T16:29:40+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-29T16:29:40Z","model":"claude-haiku-5-5","output":{"fix":"- Crawl4AI: move to `0.9.5` or later.","reach":"network","title":"Crawl4AI: Docker API lets authenticated clients load malicious model, run code","impact":"high","summary":"Crawl4AI versions from 0.9.0 before 0.9.5 do not filter the CosineStrategy model_name field in untrusted Docker API request bodies. An authenticated client can make the server load an arbitrary HuggingFace model, and a malicious repository with a pickle weight file can run Python code under PyTorch below 2.6, or exhaust disk and memory.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["crawl4ai","docker","python","pytorch","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server runs attacker-chosen Python code or exhausts disk and memory","analyst_note":"Confirm the fixed version and whether the Docker API is enabled by default; check the upstream advisory for the 0.9.5 fix note.","how_to_check":"- Check the installed Crawl4AI version, for example with `pip show crawl4ai` or the image tag of the Docker deployment.\n- Check whether the Docker API is reachable by clients outside the team.\n- Check the PyTorch version in the server image, for example with `python -c \"import torch; print(torch.__version__)\"`.","plain_action":"","needs_analyst":true,"not_affected_if":["library-only-use","pytorch-2.6-or-later"],"who_is_affected":"Teams running the Crawl4AI Docker API from 0.9.0 up to but not including 0.9.5, especially where API clients are authenticated but not fully trusted. The risk is greater where PyTorch is below 2.6, since pickle weights can execute code on load. Deployments that do not expose the Docker API or that run the pinned model only can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4167,"output_tokens":691,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119120':14A,17A '-2026':13A,16A '0.9.0':31B,84C '0.9.5':33B,86C '2.6':76B,130C 'ai':19B 'ai-tool':18B 'allow':101C 'api':3A,45B,98C 'arbitrari':57B 'attack':112C 'authent':5A,49B,102C 'bodi':47B,100C 'choos':105C 'client':6A,50B,103C 'code':11A,72B,126C 'cosinestrategi':38B,91C 'crawl4ai':1A,21B,28B,82C 'cve':12A,15A 'disk':79B,133C 'docker':2A,22B,44B,97C 'execut':124C 'exhaust':78B,132C 'fail':87C 'field':41B,94C 'file':68B,122C 'filter':36B,89C 'host':27B 'huggingfac':58B,107C 'let':4A 'load':7A,55B,111C 'make':52B 'malici':8A,62B,116C 'memori':81B,135C 'model':9A,39B,59B,92C,108C 'name':40B,93C 'pickl':66B,120C 'python':23B,71B,125C 'pytorch':24B,74B,128C 'refer':114C 'repositori':63B,117C 'request':46B,99C 'run':10A,70B 'self':26B 'self-host':25B 'server':54B,110C 'tool':20B 'untrust':43B,96C 'version':29B 'weight':67B,121C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Crawl4AI Docker API from 0.9.0 up to but not including 0.9.5, especially where API clients are authenticated but not fully trusted. The risk is greater where PyTorch is below 2.6, since pickle weights can execute code on load. Deployments that do not expose the Docker API or that run the pinned model only can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119120","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119120","severity":null,"published_at":"2026-10-29T16:18:04+00:00","modified_at":"2026-10-29T16:18:04+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}