CVE-2026-119120— Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name

Quick assessment

Affected

unclecode crawl4ai

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Crawl4AI 在 0.9.0 至 0.9.5 版本之前，未能对来自不可信 Docker API 请求体中的 CosineStrategy 模型的 model_name 字段进行过滤。这使得已认证的攻击者能够指定服务器加载哪个 HuggingFace 模型。攻击者可引用包含恶意 pickle 权重文件的仓库，在 PyTorch 2.6 以下版本中执行任意 Python 代码，或导致服务器磁盘和内存资源耗尽。

CVSS 7.5 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1499 · Endpoint Denial of Service T1552 · Unsecured Credentials T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name

Source: CVE Program / CVE List V5

Vulnerability Description

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
unclecode	crawl4ai	0.9.0 ~ 0.9.5	-

II. Public POCs for CVE-2026-119120

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119120

请登录查看更多情报信息。

Other References for CVE-2026-119120 (2)

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc vendor-advisory
https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-untrusted-model-loading-via-cosinestrategy-model-name third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119120

Same Patch Batch · unclecode · 2026-10-29 · 5 CVEs total

CVE-2026-119119	7.5 HIGH	Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields
CVE-2026-119118	6.5 MEDIUM	Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags
CVE-2026-119122	5.3 MEDIUM	Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
CVE-2026-119121	4.3 MEDIUM	Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

IV. Related Vulnerabilities

Same product: crawl4ai

Same vendor: unclecode

Same weakness: CWE-502