Description
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| unclecode | crawl4ai | 0.9.0 – < 0.9.5 | 0.9.5 |
References
- GitHub Security Advisory (GHSA-f856-7xp9-w3cc) vendor-advisory
- VulnCheck Advisory: Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name third-party-advisory