Database/AI/ML frameworks & serving
Crawl4AI Docker API: attacker-chosen HuggingFace model lets a client run Python on the crawler node
Impact
The Docker API server does not filter the CosineStrategy model_name field in request bodies, so an authenticated client picks which HuggingFace repository the server downloads and loads. A repository holding a pickle-format weight file executes arbitrary Python inside the server process on load when PyTorch is older than 2.6. On a GPU node that is code execution with whatever privileges and GPU access the crawler container holds, including its credentials, mounted volumes and network position. Even where torch is new enough to block the pickle path, the same field lets a client pull arbitrary large models and exhaust disk and host memory on the node.
Who can reach it
Any client authenticated to the Crawl4AI Docker API (/crawl and related endpoints) that can submit an extraction strategy body. Requires low privileges, not administrative access, and outbound network reachability from the node to HuggingFace.
What to do
Upgrade Crawl4AI to 0.9.5 or later and restart the API container. Where an immediate upgrade is not possible, pin PyTorch to 2.6 or newer so pickle weight loading is refused, block the container's outbound access to model hubs, and put the API behind an authenticated proxy that rejects client-supplied model_name. Container image replacement and restart; no node reboot.
References
Related entries
- LangGraph MongoDB checkpoint and store: filter dicts allow MQL operator injection across tenantsCVE-2026-55253 · langgraph-checkpoint-mongodb / langgraph-store-mongodb (MongoDBSaver.list, MongoDBStore.search filters)High
- Kedro-Datasets PyTorchDataset: torch.load without weights_only executes code from .pt filesCVE-2026-62997 · kedro-datasets PyTorchDataset (kedro_datasets_experimental.pytorch)High
- SitemapLoader: nested sitemap entries skip restrict_to_same_domain, giving readable SSRFCVE-2026-72848 · langchain-community SitemapLoader (nested sitemap index entries)High
- JupyterLab: missing await skips extension allowlist check for direct PyPIExtensionManager callersCVE-2026-73626 · JupyterLab PyPIExtensionManager.install() (extension allowlist/blocklist enforcement)High
- Headroom LLM proxy: client-chosen upstream base URL enables SSRF and leaks the Authorization headerCVE-2026-77775 · Headroom LLM proxy (x-headroom-base-url upstream selection)High
- JupyterLab: XSS via untrusted notebook contentCVE-2024-43805 · JupyterLabHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.