CVE Watch29 oct 2026

CVE-2026-119120

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authen

CVSS

7.5

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 29 oct 2026 · Última mod.: 29 oct 2026 · CWE-502

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-621319.8 CRÍ

—

———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.4h CVE-2026-620189.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.4h CVE-2026-620179.8 CRÍ

—

———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.4h CVE-2026-620169.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.4h CVE-2026-620159.8 CRÍ

—

———Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.4h CVE-2026-620149.8 CRÍ

—

———Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.4h