EUVD-2026-24752
GHSA-rxpq-xgqx-fr7p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
A flaw was found in InstructLab. The linux_train.py script hardcodes trust_remote_code=True when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run ilab train/download/generate with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.
AnalysisAI
Remote code execution in InstructLab affects Red Hat Enterprise Linux AI 3 when users download or train models from HuggingFace Hub. The linux_train.py script hardcodes trust_remote_code=True, allowing attackers to execute arbitrary Python code by hosting malicious models on HuggingFace and convincing users to run ilab train, download, or generate commands. This configuration weakness enables complete system compromise through social engineering attacks. CVSS 8.8 with network vector but requires user interaction, reducing automatic exploitation risk. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Technical ContextAI
This vulnerability stems from CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The HuggingFace Transformers library supports a trust_remote_code parameter that, when enabled, allows model repositories to include and execute arbitrary Python code during model loading. InstructLab's linux_train.py script hardcodes this parameter to True without user consent or validation. The affected product is Red Hat Enterprise Linux AI (RHEL AI) 3, which bundles InstructLab for training and fine-tuning large language models. When users invoke ilab commands (train/download/generate) pointing to HuggingFace model repositories, the application automatically executes any Python code embedded in the model's configuration files (modeling.py, tokenization.py, etc.) with the privileges of the user running the command. This design pattern is common in ML tooling but becomes a critical vulnerability when trust decisions are hardcoded rather than user-controlled.
RemediationAI
Apply vendor-released patches from Red Hat for RHEL AI 3 per advisory at https://access.redhat.com/security/cve/CVE-2026-6859. The fix should modify linux_train.py to either remove the hardcoded trust_remote_code=True parameter or require explicit user confirmation before enabling remote code execution. Until patches are applied, implement these compensating controls: First, restrict ilab command usage to trusted model repositories only by configuring allowlists of approved HuggingFace organizations/repositories in organizational policy. Second, run ilab commands in isolated containers or virtual machines with network egress filtering to limit blast radius if malicious code executes. Third, implement mandatory security review of all HuggingFace models before download, inspecting repository contents for suspicious Python files in model configs. Fourth, use SELinux or AppArmor policies to restrict file system and network access for processes running ilab commands. Note that disabling HuggingFace model downloads entirely breaks InstructLab's core functionality, so isolation and vetting are the most practical mitigations. Organizations should also monitor for unexpected network connections or file modifications during model download operations as potential indicators of exploitation.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today