CVE-2026-6855

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the logsdir parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to...

CVE-2026-6855

CVE-2026-6855 affects InstructLab. A path traversal flaw in the chat session handler can be triggered by manipulating the logs_dir parameter, enabling a local attacker to create directories and write files to arbitrary system locations, potentially causing data modification or disclosure. The iss...

CVE-2026-6855 Instructlab: instructlab: path traversal allows arbitrary directory creation and file write

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the logsdir parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to...

CVE-2026-6855 Instructlab: instructlab: path traversal allows arbitrary directory creation and file write

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the logsdir parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to...

PT-2026-34336

Name of the Vulnerable Software and Affected Versions InstructLab affected versions not specified Description A flaw exists in the linux train.py script which hardcodes the trust remote code variable as True when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary...

PT-2026-34328

Name of the Vulnerable Software and Affected Versions InstructLab affected versions not specified Description A path traversal flaw exists in the chat session handler. A local attacker can manipulate the logs dir parameter to create new directories and write files to arbitrary locations on the...

Directory Traversal

Overview instructlab is a Core package for interacting with InstructLab Affected versions of this package are vulnerable to Directory Traversal via the chat session handler. An attacker can create new directories and write files to arbitrary locations on the system by manipulating the logsdir...

instructlab-sdg (>=0.0.1 <=0.0.1rc4) potentially affected by CVE-2026-6855 via instructlab (=0.17.2)

instructlab PYPI version =0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on instructlab and may be impacted: - instructlab-sdg =0.0.1, =0.0.1rc4 Source cves: CVE-2026-6855 Source advisory: SNYK:PYTHON-INSTRUCTLAB-16323380...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (AMD)

Red Hat Enterprise Linux AI 1.5 AMD is now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This container provides NVIDIA hardware enablement and the InstructLab...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)

Red Hat Enterprise Linux AI 1.5 NVIDIA is now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This container provides NVIDIA hardware enablement and the InstructLab...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (Intel Gaudi)

Red Hat Enterprise Linux AI 1.5 Intel Gaudi is now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This container provides NVIDIA hardware enablement and the...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (Intel Gaudi)

Red Hat Enterprise Linux AI 1.5 Intel Gaudi is now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This container provides NVIDIA hardware enablement and the...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (AMD)

Red Hat Enterprise Linux AI 1.5 AMD is now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This container provides NVIDIA hardware enablement and the InstructLab...

Important: Red Hat Security Advisory: Red Hat Enterprise Linux AI 1.5 (NVIDIA)

Red Hat Enterprise Linux AI 1.5 NVIDIA is now available. Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models LLMs for enterprise applications. This container provides NVIDIA hardware enablement and the InstructLab...

data-agora (=0.1.1), dtx (>=0.31.0 <=0.34.0) +10 more potentially affected by CVE-2024-10044 via fastchat (=0.1.0)

fastchat PYPI version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastchat and may be impacted: - data-agora =0.1.1 - dtx =0.31.0, =0.2.0, =0.18.3, =0.0.2, =0.4.0, =0.0.1, =0.1.3, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-10044 Source...

akasha-terminal (>=0.8.0 <=0.8.23), coconut-ai (>=0.2.0 <=1.0.0) +7 more potentially affected by CVE-2024-34359 via llama-cpp-python (>=0.2.32 <=0.2.67)

llama-cpp-python PYPI version =0.2.32, =0.8.0, =0.2.0, =0.1.5, =0.0.1, =0.2.2, =0.0.7, =1.8.1.dev11, =0.0.20, =0.0.26 Source cves: CVE-2024-34359 Source advisory: OSV:GHSA-56XG-WFCC-G829...