Threats tagged 'ghsa-3x32-3792-pvfc'

Crawl4AI versions from 0.9.0 up to but not including 0.9.5 have a vulnerability where the CosineStrategy model_name field in Docker API request bodies is not properly filtered. This allows authenticated clients to specify which HuggingFace model the server loads, potentially referencing malicious repositories. Exploitation can lead to arbitrary Python code execution under PyTorch versions below 2.6 or resource exhaustion via disk and memory consumption.