Doctor-Dignity EUVD-2026-104249

Exploitation requires the attacker to control the model_lib argument passed into the ChatModule load path (_get_lib_module) in python/mlc_chat/chat_module.py, and per the CVSS UI:P metric a victim must actively load that attacker-supplied model library or configuration. Limiting factors: model_lib is normally an operator-supplied, load-time parameter rather than data from an exposed network service, so the claimed 'remote' reach depends on tricking a user into loading a malicious model spec; there is no authentication layer in this library to defeat, but there is also no default internet-facing listener that accepts this input unattended, which substantially narrows realistic attack surface.

Signals point to LOW real-world priority. The supplied CVSS 4.0 base score is 2.1 (Low) with vector AV:N/AC:L/PR:N/UI:P and only Low vulnerable-system impacts (VC:L/VI:L/VA:L), while exploit maturity is E:P (proof-of-concept). This conflicts with the CWE-94 'code injection' classification and the 'RCE' tag, which normally imply High impact - the input simultaneously labels this remote code execution yet scores every impact as merely Low, so the severity framing is internally inconsistent and should be treated with caution. There is no EPSS score and no CISA KEV listing provided, so there is no evidence of widespread or active exploitation; a public POC exists but POC availability is not exploitation. Critically, the affected code path (_get_lib_module consuming the model_lib argument) is an operator-supplied load-time parameter, which undercuts the claimed AV:N/PR:N remote-unauthenticated posture - realistically a victim must load an attacker-supplied model library specification (consistent with the UI:P requirement). Net: a low-severity finding on an unmaintained hobby/research project, disclosed by VulDB with no vendor response, not a fleet-wide emergency.

An attacker crafts a malicious model_lib value (or a model configuration referencing one) and induces a user/operator to load it through the chat module; when _get_lib_module processes the unsanitized model_lib argument, attacker-controlled Python is injected and executed in the victim's process. A public proof-of-concept (poc.zip attached to the GitHub issue) demonstrates the injection, and CVSS UI:P indicates the victim must perform the loading action.