7.5
HighCVSS 3.1 · from VulnCheck
CVE-2026-119120
Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
crawl4ai · Unsafe deserialization · CWE-502Affectedcrawl4ai
FixUpdate to 0.9.5 or newer
PublishedOct 29, 15:58 · VulnCheck
ScoredOct 29 · 7.5 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incrawl4ai0.9.0 – before 0.9.50.9.5crawl4aiNot affected0.9.5
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known