Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.9.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Crawl4AI, an open-source web crawling library, is affected when its Docker API accepts a user-supplied model name for the CosineStrategy feature without restriction. This lets authenticated clients make the server load an arbitrary HuggingFace model, which can lead to remote code execution through malicious pickle weights when PyTorch is below 2.6, or to disk and memory exhaustion.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- unclecode crawl4ai
From 0.9.0 · fixed in 0.9.5