{"id":"CVE-2026-115802","kind":"vulnerability","aliases":["CVE-2026-115802"],"related":[],"title":"InternAgent: LoRA loading lets remote attackers pull untrusted model code","description":"A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.","summary":"InternAgent 1.5.0 has a weakness in the train function of tasks/AutoChem/code/experiment.py, where the base_model_name_or_path argument is used to load functionality from an untrusted source. A remote attacker who supplies a crafted value can get their own code included and run.","severity":"medium","cvss":5.0,"epss":0.00486,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","internagent","python"],"not_affected_if":["unknown"],"how_to_check":"- Check whether the installed InternAgent version is `1.5.0` in the project's package or release metadata.\n- Search the code for `base_model_name_or_path` in `tasks/AutoChem/code/experiment.py` and see whether it reaches a model loading call with remote code trust enabled.","fix":"- unknown","status":"open","published_at":"2026-10-24T07:16:46+00:00","first_seen_at":"2026-10-24T08:17:08+00:00","triaged_at":"2026-10-25T04:29:20+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-25T04:29:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"InternAgent: LoRA loading lets remote attackers pull untrusted model code","impact":"high","summary":"InternAgent 1.5.0 has a weakness in the train function of tasks/AutoChem/code/experiment.py, where the base_model_name_or_path argument is used to load functionality from an untrusted source. A remote attacker who supplies a crafted value can get their own code included and run.","category":"ai-tooling","nicknames":[],"who_cares":["ai-tooling","python","internagent"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker-supplied code runs on the server running training","analyst_note":"Confirm the trigger path to train() and whether a fixed version exists; check the NVD entry and the upstream InternAgent repository for a patch.","how_to_check":"- Check whether the installed InternAgent version is `1.5.0` in the project's package or release metadata.\n- Search the code for `base_model_name_or_path` in `tasks/AutoChem/code/experiment.py` and see whether it reaches a model loading call with remote code trust enabled.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running InternAgent 1.5.0 with the AutoChem LoRA loading path reachable from remote input. The sources do not say whether the default configuration exposes this path, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000597,"input_tokens":3336,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115802':13A,16A '-2026':12A,15A '1.5.0':23B,74C 'affect':76C 'ai':18B 'ai-tool':17B 'argument':40B,93C 'attack':6A,52B,108C,127C 'avail':118C 'base':35B,94C 'caus':99C 'code':10A,62B 'compon':86C 'control':105C 'could':123C 'craft':56B 'cve':11A,14A 'exploit':114C 'file':82C 'function':30B,45B,78C,102C 'get':59B 'identifi':70C 'includ':63B 'inclus':100C 'initi':111C 'internag':1A,20B,22B,73C 'internsci':72C 'let':4A 'load':3A,44B,88C 'lora':2A,87C 'made':117C 'manipul':90C 'may':109C 'model':9A,36B,95C 'name':37B,96C 'path':39B,98C 'public':121C 'pull':7A 'python':21B 'remot':5A,51B,112C 'run':65B 'sourc':49B 'sphere':106C 'suppli':54B 'tasks/autochem/code/experiment.py':32B,83C 'tool':19B 'train':29B,79C 'untrust':8A,48B,104C 'use':42B,125C 'valu':57B 'weak':26B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams running InternAgent 1.5.0 with the AutoChem LoRA loading path reachable from remote input. The sources do not say whether the default configuration exposes this path, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T07:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115802","severity":null,"published_at":"2026-10-24T07:16:46+00:00","modified_at":"2026-10-24T07:16:46+00:00","first_seen_at":"2026-10-24T08:17:08+00:00","fetched_at":"2026-10-24T08:17:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115802","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115802","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}