CVE-2026-119120 in Crawl4AI
Summary
by MITRE • 10/29/2026
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Crawl4AI versions prior to 0.9.5 represents a critical insecure deserialization flaw rooted in the improper validation of user-supplied input within Docker API request bodies. Specifically, the CosineStrategy component fails to sanitize or restrict the model_name field, which is intended to specify the HuggingFace transformer model for processing web content. This lack of strict filtering allows authenticated clients to inject arbitrary values into this parameter, effectively bypassing application-level controls that are designed to limit resource consumption and ensure system integrity. The core technical flaw lies in the assumption that the provided model name corresponds only to legitimate, pre-approved repositories on HuggingFace Hub, ignoring the potential for attackers to point the loading mechanism toward maliciously crafted repositories containing dangerous artifacts.
When an attacker supplies a reference to a repository containing a pickle weight file as part of the model_name parameter, they exploit Python's native pickle module deserialization capabilities. PyTorch versions below 2.6 are particularly susceptible because their model loading routines may automatically deserialize these weights during initialization without sufficient security checks. Pickle files can contain arbitrary Python code that executes upon unpickling. Consequently, an authenticated attacker who successfully submits a malicious request can trigger the execution of this embedded payload with the privileges of the Crawl4AI server process. This constitutes a Remote Code Execution vulnerability where the application acts as an unwitting agent for the attacker's commands, potentially leading to full system compromise depending on the isolation level of the container environment.
Beyond code execution, this flaw also facilitates severe Denial of Service attacks through resource exhaustion. Even if deserialization is mitigated or prevented by specific PyTorch configurations, the ability to specify arbitrary model names allows attackers to direct the server toward repositories with excessively large weight files or those designed to consume significant computational resources during loading. By repeatedly requesting models that require substantial disk space and memory allocation, an attacker can deplete system resources, causing service degradation or complete unavailability for legitimate users. This dual nature of the vulnerability—enabling both arbitrary code execution and resource exhaustion—significantly elevates its severity rating within threat modeling frameworks.
From a classification perspective, this issue aligns with CWE-502 Deserialization of Untrusted Data, as it involves processing external input that can lead to unintended side effects or remote code execution. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter for the Python-based payload execution aspect, and potentially T1496 Resource Hijacking if utilized primarily for denial of service purposes. The vulnerability highlights a common pitfall in applications that interface with external model registries like HuggingFace Hub: failing to enforce allowlists or strict validation on identifiers that control dynamic resource loading.
To mitigate this risk, immediate action is required by upgrading Crawl4AI to version 0.9.5 or later where the filtering logic for the CosineStrategy has been corrected. In environments where an upgrade is not immediately feasible, administrators should implement network-level controls such as firewall rules that restrict outbound connections from the application container to only known and trusted HuggingFace domains, preventing access to malicious repositories entirely. Additionally, deploying a Web Application Firewall with specific rule sets capable of detecting anomalous patterns in API request bodies related to model loading can provide an additional layer of defense. It is also advisable to run Crawl4AI processes under restricted user privileges with minimal permissions and limited disk write capabilities to reduce the blast radius should exploitation occur. Regular auditing of dependencies, particularly PyTorch versions, ensures that known deserialization vulnerabilities in underlying libraries are patched, further hardening the application against this class of attacks.