Axolotl
Monthly
Remote code execution in Axolotl through 0.18.0 allows an attacker who controls a Hugging Face model repository to execute arbitrary Python code on any machine running an Axolotl training job with multipack patches enabled. The root cause is a logic flaw in `_apply_multipack_patches()`: when a user has not explicitly set `trust_remote_code` in their YAML config (leaving it as Python `None`), the guard condition `self.cfg.trust_remote_code is not None` evaluates to `False`, skipping the override assignment and leaving `has_remote_code=True` from the model's own metadata claim. Downstream code in `multipack.py` then calls `AutoModelForCausalLM.from_pretrained` with `trust_remote_code=True` hardcoded, executing whatever Python the model repository supplies. No public exploit is identified at time of analysis, but the attack surface is broad for teams running automated fine-tuning pipelines that source models from HuggingFace without explicit config hardening.
Remote code execution in Axolotl through 0.18.0 allows an attacker who controls a Hugging Face model repository to execute arbitrary Python code on any machine running an Axolotl training job with multipack patches enabled. The root cause is a logic flaw in `_apply_multipack_patches()`: when a user has not explicitly set `trust_remote_code` in their YAML config (leaving it as Python `None`), the guard condition `self.cfg.trust_remote_code is not None` evaluates to `False`, skipping the override assignment and leaving `has_remote_code=True` from the model's own metadata claim. Downstream code in `multipack.py` then calls `AutoModelForCausalLM.from_pretrained` with `trust_remote_code=True` hardcoded, executing whatever Python the model repository supplies. No public exploit is identified at time of analysis, but the attack surface is broad for teams running automated fine-tuning pipelines that source models from HuggingFace without explicit config hardening.