Vulnerability Bulletins |
CVE-2026-119120 |
|
| Affected software | DOCKER |
| Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-119120 | |