What happened
CVE-2026-119120 / GHSA-f856-7xp9-w3cc: the Crawl4AI Docker API server does not filter the CosineStrategy.model_name field in untrusted request bodies. An authenticated client can make the server download and load any HuggingFace model repository via AutoTokenizer/AutoModel.from_pretrained. On deployments with PyTorch older than 2.6 (before the CVE-2025-32434 fix), a crafted .bin pickle weight file in that repository runs arbitrary Python in the server process; with newer PyTorch the client can still force the server to download and hold any model in memory, exhausting disk/memory. Fixed in 0.9.5.
Why it matters
A model-serving crawler endpoint becomes a code-execution surface: an authenticated caller selects the model, and a malicious repository executes in the server process with access to environment variables (LLM provider keys) and reachable files. For AI deployments it is a direct model-loading RCE path.
Attack vector
Send a /crawl request with extraction_strategy CosineStrategy and attacker model_name; server downloads and loads the chosen HF repo, executing a pickle payload under PyTorch <2.6.
Affected systems
Crawl4AI 0.9.0 to before 0.9.5 (Docker server with CosineStrategy/model_name).
Mitigation
Upgrade to 0.9.5 (untrusted bodies may no longer set model_name); upgrade PyTorch to 2.6+; reject request bodies containing model_name at a proxy; pre-fill the HF cache and set HF_HUB_OFFLINE=1.