What is the CVSS score of CVE-2026-31228?

CVE-2026-31228 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-31228?

Within 24 hours: Identify all systems running ART versions ≤1.20.1, prioritizing those with Kubeflow robustness evaluation components exposed to untrusted networks. Within 7 days: Implement network segmentation to restrict access to ART Kubeflow evaluation endpoints to authenticated internal users only; disable or isolate the robustness evaluation component if not actively required. Within 30 days: Monitor vendor advisories for patched ART releases; when available, upgrade to the first patched version released after 1.20.1 and conduct full security regression testing on model evaluation pipelines.

Adversarial Robustness Toolbox CVE-2026-31228

EUVD-2026-29511 CRITICAL

Code Injection (CWE-94)

2026-05-12 mitre

GHSA-8r6g-7rr9-mx32

Python Code Injection RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 15:56 vuln.today

CVSS changed

May 13, 2026 - 15:52 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval() function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without any sanitization or security restrictions. An attacker can exploit this by providing a specially crafted string that contains arbitrary Python code, which will be executed when eval() is called, leading to complete compromise of the system running the ART evaluation.

AnalysisAI

Remote code execution in Adversarial Robustness Toolbox (ART) versions through 1.20.1 allows unauthenticated network attackers to execute arbitrary Python code via unsafe eval() usage in the Kubeflow robustness evaluation component. The vulnerability accepts unsanitized user input for LossFn and Optimizer parameters in PyTorch model evaluations, enabling complete system compromise. With CVSS 9.8 but only 0.06% EPSS score (18th percentile), this represents a severe theoretical risk that has not yet manifested in widespread exploitation. No public exploit code identified at time of analysis, and the vulnerability requires specific deployment of ART's Kubeflow integration component.

Technical ContextAI

The Adversarial Robustness Toolbox is a Python library for machine learning security, providing tools to defend and evaluate ML models against adversarial threats. This vulnerability affects the Kubeflow component specifically-Kubeflow being a platform for deploying ML workflows on Kubernetes. The root cause (CWE-94: Improper Control of Generation of Code) stems from Python's eval() function being used to dynamically instantiate PyTorch loss functions and optimizers during robustness evaluations. The eval() function executes arbitrary Python expressions from strings, and without input validation, attackers can inject malicious code disguised as legitimate parameter specifications. This pattern is particularly dangerous in ML infrastructure where model evaluation pipelines often accept configuration parameters from external sources or API requests. The CPE data shows 'n/a' values, indicating limited structured vendor identification in vulnerability databases, though the GitHub repository confirms this is the Trusted-AI/adversarial-robustness-toolbox project.

RemediationAI

Upgrade to Adversarial Robustness Toolbox version 1.20.2 or later when released, monitoring the project's GitHub repository at https://github.com/Trusted-AI/adversarial-robustness-toolbox for security patches. As of this analysis, no vendor-released patched version is independently confirmed in the provided data. Until a patch is available, implement the following compensating controls: First, restrict network access to Kubeflow robustness evaluation endpoints using firewall rules or Kubernetes NetworkPolicies, allowing only trusted internal systems-this prevents remote exploitation but limits functionality for distributed workflows. Second, implement input validation by wrapping the evaluation function to whitelist only known-safe LossFn and Optimizer class names (e.g., 'torch.nn.CrossEntropyLoss', 'torch.optim.Adam') before passing to eval(), rejecting any input containing parentheses, quotes, or Python keywords-trade-off is breaking support for custom loss functions. Third, run ART evaluation workloads in isolated containers with minimal privileges (non-root user, read-only filesystem, no network egress) to contain post-exploitation impact-reduces damage but doesn't prevent initial code execution. Review application logs for unexpected evaluation parameter values as potential exploitation attempts.