An extraction option named model_name sounds like data describing a search strategy. In affected Crawl4AI Docker configurations, it reached Hugging Face tokenizer and model loading routines. A client that could submit extraction configuration could therefore select which third-party model artifacts the service downloaded and loaded, bypassing restrictions…
Case · DiggingBeagle record
Crawl4AI untrusted extraction configuration could load arbitrary model artifacts
Untrusted Crawl4AI extraction settings could select a remote Hugging Face model and trigger loading outside the crawler’s ordinary outbound restrictions.
Scope
Crawl4AI Docker API 0.9.0 through 0.9.4 when the relevant extraction extras are installed and a client can set CosineStrategy model_name; patched in 0.9.5. Code execution additionally depends on unsafe model deserialization paths.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Impact
- Band 3 of 4
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
GHSA-f856-7xp9-w3cc confirms CosineStrategy model_name reached Hugging Face AutoModel without allowlisting or the standard egress proxy. In current safe deserializers the bounded consequence is memory/resource exhaustion rather than the full execution chain. The advisory reports a 0.9.5 patch and does not document exploited customers.
Impact basis: A token-authorized Docker API client could force arbitrary model downloads and, under older unsafe PyTorch and Transformers configurations with relevant extras, trigger server-side Python execution. Band applies to that explicit vulnerable dependency combination, not the default installation.
Assessed Oct 19, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CRAWL4AI-HF-MODEL-LOADING · GHSA-f856-7xp9-w3cc: Crawl4AI untrusted extraction configuration could load arbitrary model artifacts
At a glance
A request that merely appears to select a similarity model can cause network retrieval and deserialization of artifacts. Loading authority must therefore reside in a deployment-level allowlist rather than in the crawl request.
Read the implicationsThe code path required the affected Docker extraction configuration and optional dependency versions for the stronger code-execution outcome. Ordinary default installations were not all affected; no live attack is documented.
Limits and uncertaintyFull account
An extraction option named model_name sounds like data describing a search strategy. In affected Crawl4AI Docker configurations, it reached Hugging Face tokenizer and model loading routines. A client that could submit extraction configuration could therefore select which third-party model artifacts the service downloaded and loaded, bypassing restrictions placed on normal page fetching.
The practical effect depends on installed packages. The advisory identifies configurations with model-loading extras; it does not claim that the default minimal Docker installation executed arbitrary model code. Older unsafe serialization dependencies, including particular PyTorch versions and pickle-based artifact paths, created a stronger code-execution possibility, while other combinations exposed resource and artifact-provenance risks. A remote model location is not, by itself, proof that a malicious command ran on the host.
Version 0.9.5 introduced the reported correction. A meaningful regression test must supply an untrusted model identifier and inspect actual artifact acquisition and deserialization, not merely confirm that the web crawler's primary network proxy rejects internal URLs. This finding illustrates artifact authority entering through an apparently ordinary model-selection parameter.
Claims & evidence
CLM-CRAWL4AI-HF-MODEL-LOADINGAn API client could select the Hugging Face model loaded by the extraction service through CosineStrategy model_name.supported
Basis: reported finding
- supportsGHSA-f856-7xp9-w3cc: Crawl4AI untrusted extraction configuration could load arbitrary model artifactsprimary disclosure
Untrusted CosineStrategy model_name; fixed v0.9.5
Implications
A request that merely appears to select a similarity model can cause network retrieval and deserialization of artifacts. Loading authority must therefore reside in a deployment-level allowlist rather than in the crawl request.
Controls and mitigations
- Allowlist deployable models, pin artifact identity and restrict model loading to an independently authorized service.
Unknowns and contradictions
- The code path required the affected Docker extraction configuration and optional dependency versions for the stronger code-execution outcome. Ordinary default installations were not all affected; no live attack is documented.
Sources and citation
Material revision history
- Oct 19, 2026 · Published version · first publication · revision 174
- Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile