InternAgent EUVD-2026-109220

Exploitation requires the AutoChem 'train' function in tasks/AutoChem/code/experiment.py to be invoked with a base_model_name_or_path argument that the attacker can influence, causing the LoRA loading logic to include functionality from an untrusted control sphere. The limiting factor is the CVSS UI:P / user-interaction requirement: a legitimate operator must actually run the training routine with the malicious path value - the flaw does not trigger passively against an idle default deployment. No authentication is indicated (PR:N), but the precise mechanism by which base_model_name_or_path reaches the vulnerable call, and whether it yields full code execution, is not described in the available sources.

This is a moderate-severity issue, not an emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N, base 5.3) describes a network-reachable flaw that needs no privileges but DOES require passive user interaction (UI:P) - meaning an operator must actually invoke the training routine with the attacker-influenced argument. Impact is confined to low integrity (VI:L) with no confidentiality (VC:N) or availability (VA:N) effect, which is consistent with inclusion of untrusted functionality (CWE-829) rather than data theft. The vuln.today Decision label is 'this_month', signalling a scheduled-remediation priority rather than act_now/emergency. The exploit maturity is E:P (proof-of-concept): a public PoC reference exists but is not verified as working exploit code, so this should not be treated as confirmed active exploitation. There is no CISA KEV listing and no EPSS probability in the provided data, so widespread automated exploitation cannot be asserted. Note a signal conflict: the input Tag 'Information Disclosure' is inconsistent with the CVSS vector's VC:N (no confidentiality impact) - the actual impact is integrity via untrusted code/model inclusion, not disclosure; weight the vector over the tag.

An attacker convinces or configures an InternAgent operator to run the AutoChem 'train' routine with a base_model_name_or_path value pointing at an attacker-controlled source, causing the LoRA loader to pull in functionality from an untrusted control sphere. A public PoC reference (poc.zip) exists but is not verified as working exploit code, and the CVSS UI:P requirement means the victim must initiate the training run for the attack to land.