DeepInfer CVE-2026-120204

The DeepInfer profiling HTTP server must be running and bound to a network-reachable interface; pre-patch it bound to 0.0.0.0 by default and exposed the /profile endpoint without authentication (PR:N). The AT:P metric reflects that the profiler collection path must be active/triggerable for the request to succeed. Pre-patch the endpoint accepted GET requests and merged URL query parameters into the request body, which is precisely what enabled cross-site forgery from an operator's browser via <img>/<form> elements. Limiting factors: impact is confined to directory creation, trace-file writes (disk/inode exhaustion), and a filesystem-existence oracle via error messages - there is no code execution or high-impact data disclosure; exploitation also depends on the non-default decision to run the profiler and expose it beyond loopback. The patch binds to 127.0.0.1 by default, restricts the endpoint to POST with JSON body only, and confines output_dir to the DEEPINFER_TORCH_PROFILER_DIR subtree via realpath checks.

This is a genuine but modest-severity issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a network-reachable, unauthenticated endpoint with low attack complexity, and all three impacts are rated Low (VC:L/VI:L/VA:L) - there is no code execution, no scope change, and no high-confidentiality exposure. The AT:P (attack requirement present) signal is important: exploitation is contingent on the profiling HTTP server actually running and being reachable, which is a non-default operational condition rather than an always-on surface. No EPSS score, no CISA KEV listing, and no confirmed working exploit are present in the input, so there is no evidence of active exploitation - only a vendor/VulnCheck-documented flaw with a patch. The vuln.today Decision label is 'this_month', consistent with a patch-on-normal-cadence priority rather than act_now/emergency. In short, the signals are internally consistent: real and remotely reachable, but bounded impact (disk/inode exhaustion plus a filesystem-existence oracle) and gated on the profiler being enabled. Note the input provides no EPSS/KEV data at all, so widespread-exploitation likelihood cannot be quantified from the available signals.

An attacker who can reach a DeepInfer node with the profiling HTTP server running (pre-patch it bound to 0.0.0.0 by default) sends a request to the unauthenticated /profile endpoint with a crafted output_dir value containing path traversal sequences, causing the server to create arbitrary directories and write Torch/Chrome trace files outside the intended profiler directory. Because the pre-patch endpoint also honored GET and merged query parameters, the request can be forged cross-site from an operator's browser (e.g. via an <img>/<form> tag), letting the attacker exhaust disk or inodes and use the differing error messages as a filesystem-existence oracle. No public working exploit is identified in the provided data.