unclecode — crawl4ai
Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.
Available for technologies you monitor inside Seraph CTI.
Surfaced automatically when a documented actor is linked to this CVE.
Shown when this vendor/product is relevant to your industry.
Campaign and indicator context, where Seraph analysts have published it.
Declare your technology stack inside Seraph CTI and get notified the moment a vulnerability matches it.
