CVE-2026-122160

A flaw was found in AIlice. The Hugging Face model wrapper fails to properly restrict or validate model paths within the LoadModelPEFT function. A remote attacker could exploit this vulnerability by supplying a manipulated model path, causing the application to load and execute untrusted external...

CVE-2026-122160

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModelPEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument basemodelnameorpath leads to inclusion of...

EUVD-2026-117269

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModelPEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument basemodelnameorpath leads to inclusion of...

CVE-2026-122160 myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphere

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModelPEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument basemodelnameorpath leads to inclusion of...

CVE-2026-122160

The myshell-ai AIlice library (versions up to 0.4.0 ) contains a security vulnerability in the HuggingFace Model Wrapper component. Specifically, the LoadModel_PEFT function in ailice/core/llm/AModelCausalLM.py is susceptible to inclusion of functionality from untrusted control sphere (CWE-829). ...

PT-2026-137320

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base model name or path leads to inclusion...