What is the CVSS score of CVE-2026-31230?

CVE-2026-31230 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adversarial Robustness Toolbox are affected by CVE-2026-31230?

Adversarial Robustness Toolbox (ART) versions up to 1.20.1 contain a critical command injection vulnerability that enables unauthenticated remote code execution in Kubeflow ML pipeline environments.

How to fix or mitigate CVE-2026-31230?

Within 24 hours: inventory all systems running ART versions ≤1.20.1, prioritize instances integrated with Kubeflow or accessible via network pipelines, and restrict network access to affected systems. Within 7 days: upgrade ART to the latest available version beyond 1.20.1 and validate robustness_evaluation_fgsm_pytorch.py execution in test environments. Within 30 days: audit pipeline configuration controls to ensure ML pipeline arguments are not derived from untrusted sources, implement input validation for --clip_values and --input_shape parameters, and review CI/CD logs for suspicious eval() activity or code injection attempts.

Adversarial Robustness Toolbox CVE-2026-31230

EUVD-2026-29553 CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-05-12 mitre

GHSA-24f5-hrhx-3grp

Python RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 16:23 vuln.today

CVSS changed

May 13, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

May 12, 2026 - 00:00 nvd

CRITICAL 9.8

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py). The script uses the unsafe eval() function to parse string values provided via the --clip_values and --input_shape command-line arguments. This allows an attacker to inject arbitrary Python code into these arguments, which will be executed when eval() is called. The vulnerability can be exploited remotely if an attacker can control these arguments (e.g., through pipeline configuration or automated scripts), leading to arbitrary code execution on the system running the ART evaluation.

AnalysisAI

Command injection in Adversarial Robustness Toolbox (ART) up to version 1.20.1 enables remote code execution through unsafe eval() usage in Kubeflow pipeline components. The robustness_evaluation_fgsm_pytorch.py script directly evaluates user-controlled --clip_values and --input_shape arguments without sanitization, allowing Python code injection. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicating network-exploitable unauthenticated access, this represents critical risk in automated ML pipeline environments where attackers can control pipeline configurations. EPSS score of 0.02% (5th percentile) suggests low observed exploitation activity, though the attack vector and ML tooling context create significant supply chain risk in CI/CD and research environments.

Technical ContextAI

This vulnerability stems from CWE-88 (Argument Injection or Modification) manifesting through Python's eval() function, which executes arbitrary code from string input. The Adversarial Robustness Toolbox is a Python library for adversarial machine learning security testing, commonly deployed in Kubeflow pipelines for automated robustness evaluation. The affected component robustness_evaluation_fgsm_pytorch.py implements Fast Gradient Sign Method (FGSM) attacks against PyTorch models. The eval() calls are designed to parse clip_values (data normalization bounds) and input_shape (tensor dimensions) from command-line strings into Python data structures, but without input validation this creates a direct code execution pathway. In Kubeflow environments, these arguments may be populated from pipeline YAML configurations, API calls, or automated orchestration systems, expanding the attack surface beyond direct CLI access.

RemediationAI

Immediately upgrade to Adversarial Robustness Toolbox version 1.20.2 or later, which should address the eval() vulnerability (verify fix availability at github.com/Trusted-AI/adversarial-robustness-toolbox/releases). As of this analysis, no vendor advisory with confirmed patch version has been published; monitor the GitHub repository for security patches. If upgrade is not immediately feasible, implement these compensating controls with their trade-offs: (1) Remove or disable the robustness_evaluation_fgsm_pytorch.py Kubeflow component from production pipelines (eliminates FGSM evaluation capability), (2) Implement strict input validation on --clip_values and --input_shape arguments using regex patterns that only allow numeric values, brackets, and commas (requires code modification), (3) Run ART Kubeflow components in isolated containers with no network access and minimal privileges using Kubernetes SecurityContext with readOnlyRootFilesystem=true and runAsNonRoot=true (reduces blast radius but adds operational complexity), (4) Restrict Kubeflow pipeline configuration access to authenticated administrators only and audit all pipeline definition changes (does not prevent exploitation if admin credentials are compromised). The safest short-term mitigation is disabling the vulnerable component entirely until patched versions are confirmed available.