What is GHSA-3x32-3792-pvfc?

GHSA-3x32-3792-pvfc is a security advisory published by GitHub Security Advisories with High severity. Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted...

Which CVE IDs does GHSA-3x32-3792-pvfc cover?

GHSA-3x32-3792-pvfc covers the following CVE IDs: CVE-2026-119120. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3x32-3792-pvfc?

GHSA-3x32-3792-pvfc has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-3x32-3792-pvfcHighCVSS 7.5

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted...

Vendor

GitHub Security Advisories

Published

October 29, 2026

Last Modified

October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-119120 →

📋 Description

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.

🔗 References (4)

https://github.com/unclecode/crawl4ai/security/advisories/GHSA-f856-7xp9-w3cc
https://nvd.nist.gov/vuln/detail/CVE-2026-119120
https://www.vulncheck.com/advisories/crawl4ai-0.9.0-before-0.9.5-untrusted-model-loading-via-cosinestrategy-model-name
https://github.com/advisories/GHSA-3x32-3792-pvfc