Windows ML CLI EUVD-2026-70264

The winml-cli serve command must be actively running on the victim's machine - this is a developer-invoked command, not a default installed service, so exploitation is limited to the window when a developer has explicitly started the server. The victim must concurrently visit or be redirected to a malicious webpage while the server is running; the browser's Same-Origin Policy is the sole protection, which the wildcard CORS configuration eliminates entirely. The exploitable endpoints are /v1/cli/build and /v1/cli/config; an attacker's page can probe likely localhost ports if the exact port is unknown. No API authentication, special privileges, or non-default configuration beyond running the serve subcommand is required. Only versions prior to 0.4.0 are vulnerable.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) reflects the realistic threat model accurately: the API is effectively network-accessible via any browser tab, no authentication is required, but active user interaction - visiting a malicious site while the server is running - is a mandatory precondition. Real-world risk is bounded by the requirement that the victim be a developer actively running winml-cli serve, a non-default, explicitly invoked developer workflow rather than an always-on production service. The primitive exploitation path (a single fetch() POST from any webpage) means the attack barrier is very low once the prerequisite server is running, and an attacker embedding this payload in a malicious or compromised site targeting AI developers represents a credible scenario. No CISA KEV listing is present and no independent PoC beyond the advisory description exists in the input, which reduces urgency marginally. EPSS data is absent from the provided input; exploitation probability cannot be independently quantified. There are no conflicting signals between the CVSS vector and the description - both indicate network-accessible, user-interaction-dependent, unauthenticated RCE.

A developer running winml-cli serve on their workstation visits a malicious webpage (or a legitimate site with injected script). The page's JavaScript issues a cross-origin fetch() POST to http://localhost:<port>/v1/cli/build with a payload setting trust_remote_code=true and a model identifier pointing to an attacker-controlled Hugging Face repository containing malicious Python. The server's wildcard CORS policy causes the browser to forward the request and honor the response; the server then calls AutoConfig.from_pretrained(trust_remote_code=True), importing the attacker's Python module and executing arbitrary code as the developer's user account.