CVE WatchOct 29, 2026

CVE-2026-119120

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authen

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 29, 2026 · Last modified: Oct 29, 2026 · CWE-502

EPSS · 30d

Not enough EPSS history yet.

Technical description

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-621319.8 CRI

—

———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.4h CVE-2026-620189.8 CRI

—

———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.4h CVE-2026-620179.8 CRI

—

———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.4h CVE-2026-620169.8 CRI

—

———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.4h CVE-2026-620159.8 CRI

—

———Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.4h CVE-2026-620149.8 CRI

—

———Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.4h