CVE-2026-119120: Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name

Published Oct 29, 2026

Updated

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy modelname field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:58 PM

Data Sourced

via MITRE·03:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated client that can submit untrusted Docker API request bodies to the affected Crawl4AI service can select the HuggingFace model to load through the CosineStrategy model_name field.

What conditions are required for code execution?

The attacker must reference a malicious HuggingFace repository containing a pickle weight file, and the server must use PyTorch below 2.6. Under those conditions, loading the model can execute Python code in the service context.

Is code execution the only impact?

No. An attacker can also select models that exhaust the server's disk space or memory, causing a denial of service.

What versions are affected?

Crawl4AI versions from 0.9.0 up to, but not including, 0.9.5 are affected.

CVE-2026-119120: Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name

Event History

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for code execution?

Is code execution the only impact?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What conditions are required for code execution?

Is code execution the only impact?

What versions are affected?