CVE-2026-86169

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

EUVD-2026-71971

Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

CVE-2026-86169

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

CVE-2026-86169

Axolotl (through 0.18.0 ), a Python-based LLM fine-tuning framework, contains a remote code execution vulnerability in its multipack patch code path. The root cause is that the trust_remote_code parameter defaults to None instead of False, effectively bypassing the security guard. An attacker who...

CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

PT-2026-86396

Name of the Vulnerable Software and Affected Versions Axolotl versions prior to 0.18.1 Description A remote code execution issue exists in the multipack patch path. The security guard is bypassed because the trust remote code variable defaults to None instead of False. An attacker can execute...

CVE-2026-86169: Inclusion of Functionality from Untrusted Control Sphere

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2026-57516 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2026-57516 Source advisory:...

axolotl (0.5.0), commit0 (>=0.1.7, <=0.1.8) +7 more potentially affected by CVE-2026-66007 via datasets (3.0.1)

datasets PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - axolotl 0.5.0 - commit0 =0.1.7, =0.6.0rc0, =0.2.1, =2.9.0, =2.9.0, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-66007 Source advisory:...

axolotl (>=0.13.1, <=0.16.1), fenris (0.1.0) +5 more potentially affected by CVE-2026-66007 via datasets (4.5.0)

datasets PYPI version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - axolotl =0.13.1, =0.2.2, =0.0.2, =1.0.3, =1.1.1 - sygra 2.0.0.post1 Source cves: CVE-2026-66007 Source advisory: OSV:PYSEC-2026-3716...

axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-49119 via gradio (5.49.1)

gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-49119 via gradio (5.49.1)

gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2026-57516 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2026-57516 Source advisory: OSV:PYSEC-2026-2...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2023-6021 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2023-6021 Source advisory: OSV:PYSEC-2026-51...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2023-6019 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2023-6019 Source advisory: OSV:PYSEC-2026-51...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2023-48022 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2023-48022 Source advisory: OSV:PYSEC-2026-5...

argos-trains (0.1.0), beta-rec (>=0.2.3, <=0.3.2) +3 more potentially affected by CVE-2025-34351 via ray (1.0.1)

ray PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - argos-trains 0.1.0 - beta-rec =0.2.3, =0.1.1, =0.2.1 - raylab 0.14.9 - tamu-axolotl 2021.4.8 Source cves: CVE-2025-34351 Source advisory: OSV:PYSEC-2026-5...

axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-10783 via gradio (5.49.1)

gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...