CVE-2026-119120

Crawl4AI lets API clients select an untrusted model repository

unclecode · Crawl4AI Docker API CosineStrategy

First documented disclosure · Review checkpoint

Summary

A client can trigger arbitrary model downloads and, with vulnerable dependencies, Python code execution.

Severity and exploitation evidence

High · 7.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The original advisory provides a controlled request/model-loading demonstration. No reviewed source establishes malicious exploitation or victim compromise.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Untrusted CosineStrategy.model_name reaches Hugging Face model loading without a repository restriction and bypasses the crawler's egress controls.

Conditions required

A valid API token, cosine/transformer/all extras and writable model cache. Code execution also needs PyTorch below 2.6 and a transformers version without the newer pickle safety check; the default Docker image lacks these extras.

Potential impact

Potential server code execution with vulnerable dependencies; otherwise attacker-chosen model downloads can exhaust disk or memory.

Affected versions and configurations

>=0.9.0 and <0.9.5. Direct library use needs an application that passes untrusted model_name values.

Fix and mitigation status

0.9.5 rejects caller-supplied model_name in untrusted requests.

Practical next steps

Upgrade, restrict model repositories and egress, and use current PyTorch/transformers. Pending upgrade reject model_name, prefill trusted models and enforce offline loading where appropriate.

Operating lesson

A model identifier is a supply-chain input and a resource-allocation capability.

Evidence and limits

The October 14 tagged release changelog publicly identifies this exact GHSA; October 2 patch authorship alone does not establish public availability. The GHSA followed October 15 and CNA October 29. VulnCheck CVSS 4.0 is 7.7; the original CVSS 3.1 is 7.5. The prerequisite dependency versions determine whether loading can execute code.

Sources