CVE-2026-108943

A code injection vulnerability exists in ModelTC LightX2V (versions up to 0.5.0 ) within the Tokenizer component. The flaw is located in the AutoTokenizer.from_pretrained function of the file lightx2v/models/runners/cosmos3/cosmos3_runner.py . By manipulating the auto_map argument, an attacker ca...

CVE-2026-108943 ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection

A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.frompretrained of the file lightx2v/models/runners/cosmos3/cosmos3runner.py of the component Tokenizer. This manipulation of the argument automap causes code injection. The attack is restricted ...