Crawl4AI CVE-2026-119120

Requires a Crawl4AI Docker API server deployment built with the cosine, transformer, or all extras (for example INSTALL_TYPE=all) and a writable HuggingFace cache - the default image (INSTALL_TYPE=default) installs neither PyTorch nor transformers and is not affected. A valid API token is required (authenticated per PR:L). The arbitrary-code-execution outcome additionally requires the server to run PyTorch older than 2.6 together with a transformers release that lacks the CVE-2025-32434 .bin-weights refusal; on PyTorch 2.6+ this path is closed and exploitation is limited to attacker-chosen model downloads that exhaust disk and memory. The library used directly is not affected unless an application passes untrusted input into CosineStrategy(model_name=...). Limiting factors: authentication, the non-default install profile, and the legacy-PyTorch precondition for code execution.

Signals are moderate and partly conditional. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.7 (High): network-reachable and high impact on the vulnerable system, but gated by PR:L (a valid API token is required) and by AC:H/AT:P, reflecting that full code execution depends on an environmental precondition the attacker does not control - the server must run PyTorch below 2.6 together with a transformers release lacking the CVE-2025-32434 guard. The vuln.today decision label is 'this_week', not act_now/emergency. There is no CISA KEV listing (not actively exploited per available data) and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the input. The GHSA advisory publishes a working-looking curl proof of concept, but the input does not mark it as confirmed weaponized exploit code. Net: this is a genuine authenticated RCE/DoS on a specific deployment profile (Docker API server with the cosine/transformer/all extras) rather than a mass-exploitable internet-wide critical - treat it as a real near-term patch priority for affected Docker operators, but its blast radius is bounded by the authentication requirement and the legacy-PyTorch precondition. On current PyTorch the code-execution path is closed and only the disk/memory-exhaustion (availability) impact remains.

An attacker holding a valid Crawl4AI Docker API token sends a crawl request whose CosineStrategy extraction_strategy sets model_name to an attacker-controlled HuggingFace repository; the server downloads and loads that repo, and on PyTorch older than 2.6 a crafted .bin pickle weight file runs arbitrary Python in the server process, exposing environment secrets such as LLM provider keys. The GHSA advisory includes a proof-of-concept curl request; because exploitation requires AC:H/AT:P conditions (legacy PyTorch and a token), it is not a trivial drive-by, and on current PyTorch the attacker is limited to forcing large model downloads that exhaust disk and memory.