ModelTC LightX2V EUVD-2026-98182

Exploitation requires that a LightX2V user (up to version 0.5.0) load an attacker-controlled tokenizer/model through the cosmos3 runner's AutoTokenizer.from_pretrained call, where the malicious model's configuration supplies a crafted auto_map value pointing to attacker code. The decisive prerequisite is loading UNTRUSTED model/tokenizer content (effectively equivalent to enabling remote/custom code loading for that model). Limiting factors that reduce real-world risk: the attack is restricted to local execution (AV:L), the attacker needs the victim to choose to load the malicious model, it runs only with the local user's existing privileges (PR:L), and there is no remote network attack surface. No fixed version is available since the project has not yet responded.

This is a low-real-risk issue despite the RCE/code-injection tags. The CVSS 4.0 vector supplied by VulDB (AV:L/AC:L/AT:N/PR:L/UI:N, VC:L/VI:L/VA:L) scores only 1.9, and every signal reinforces low severity: exploitation is restricted to local execution (AV:L), requires low privileges (PR:L), and impact to confidentiality/integrity/availability is rated Low rather than High even though the flaw is CWE-94 code injection. The reason is contextual - this is not remote unauthenticated RCE but rather code execution that occurs when a user/operator loads an attacker-supplied tokenizer/model via AutoTokenizer.from_pretrained with a malicious auto_map entry (the well-known HuggingFace trust_remote_code / auto_map class of issue), so the attacker effectively only gains the privileges of the local user who already chose to load the untrusted model. Exploitation signals: publicly available exploit code exists (referenced VulDB/GitHub issue 1559), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. No SSVC decision data was supplied. Note a conflict worth verifying: the impact is labeled 'code injection'/RCE, which normally implies High integrity impact, yet VulDB rated VI:L and scored 1.9 - the low score reflects the local, operator-dependent trust-boundary nature of the bug rather than its code-execution capability, so defenders relying only on the numeric score should understand the 'RCE' tag is technically accurate but gated behind the victim loading untrusted model content.

An attacker publishes or supplies a malicious model/tokenizer repository whose configuration contains a crafted auto_map argument; when a LightX2V user loads it through the cosmos3 runner's AutoTokenizer.from_pretrained call, the referenced remote/custom code is imported and executed on the victim's machine with that user's privileges. Because exploitation is local and depends on the victim choosing to load attacker-controlled model files, it fits a supply-chain / untrusted-model scenario rather than remote network attack. A public proof-of-concept exists (GitHub issue #1559), lowering the bar to reproduce.