{"id":"CVE-2026-116608","kind":"vulnerability","aliases":["CVE-2026-116608"],"related":[],"title":"VideoLLaMA2: model loader skips integrity check on attacker-chosen model path","description":"A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of the argument _name_or_path leads to improper validation of integrity check value. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"VideoLLaMA2 up to version 1.1 has a flaw in its load_pretrained_model function, where manipulating the _name_or_path argument bypasses integrity validation when loading a model. An attacker who can supply a model path may get a tampered model or code loaded into the process.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-models","ai-tooling","python","videollama2"],"not_affected_if":["fixed-model-path","no-user-controlled-input","not-using-videollama2"],"how_to_check":"- Check whether the installed VideoLLaMA2 version is `1.1` or lower, for example with `pip show videollama2` or by reading the package version in the project.\n- Look for calls to `load_pretrained_model` in `videollama2/model/__init__.py` that take a path or name from user input or config.","fix":"- unknown; the sources say the project has not responded to the issue report yet, so no patched version is listed.\n- Until a fix exists, only load models from trusted, pinned local paths and do not pass user-supplied model names into `load_pretrained_model`.","status":"open","published_at":"2026-10-27T01:19:05+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:29+00:00","updated_at":"2026-10-27T01:36:29+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-27T01:36:29Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources say the project has not responded to the issue report yet, so no patched version is listed.\n- Until a fix exists, only load models from trusted, pinned local paths and do not pass user-supplied model names into `load_pretrained_model`.","reach":"network","title":"VideoLLaMA2: model loader skips integrity check on attacker-chosen model path","impact":"medium","summary":"VideoLLaMA2 up to version 1.1 has a flaw in its load_pretrained_model function, where manipulating the _name_or_path argument bypasses integrity validation when loading a model. An attacker who can supply a model path may get a tampered model or code loaded into the process.","category":"ai-tooling","nicknames":[],"who_cares":["python","ai-models","videollama2"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker-supplied model loaded without integrity check, possibly running code","analyst_note":"Confirm the exploit details and whether a model load can run arbitrary code; check the NVD entry and the project issue tracker for a fix or workaround.","how_to_check":"- Check whether the installed VideoLLaMA2 version is `1.1` or lower, for example with `pip show videollama2` or by reading the package version in the project.\n- Look for calls to `load_pretrained_model` in `videollama2/model/__init__.py` that take a path or name from user input or config.","needs_analyst":true,"not_affected_if":["fixed-model-path","no-user-controlled-input","not-using-videollama2"],"who_is_affected":"Teams that run VideoLLaMA2 1.1 or earlier and let any outside input influence the model name or path passed to load_pretrained_model. Deployments that load a fixed, locally vetted model directory with no user-controlled path are much less exposed. Teams not using VideoLLaMA2 can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":3378,"output_tokens":676,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116608':15A,18A '-2026':14A,17A '1.1':31B,86C 'academi':82C 'affect':87C 'ai':20B,23B 'ai-model':19B 'ai-tool':22B 'argument':47B,110C 'attack':9A,56B,126C 'attacker-chosen':8A 'bypass':48B 'check':6A,120C 'chosen':10A 'code':69B 'compon':103C 'cve':13A,16A 'damo':81C 'detect':79C 'disclos':133C 'earli':146C 'exploit':123C,130C 'file':99C 'flaw':34B 'function':40B,93C 'get':64B 'improp':116C 'inform':142C 'integr':5A,49B,119C 'issu':90C,149C 'lead':114C 'load':37B,52B,70B,94C,105C 'loader':3A 'manipul':42B,107C 'may':63B,136C 'model':2A,11A,21B,39B,54B,61B,67B,96C,104C 'name':44B,111C 'path':12A,46B,62B,113C 'possibl':128C 'pretrain':38B,95C 'problem':145C 'process':73B 'project':140C 'public':134C 'python':25B 'remot':122C 'report':150C 'respond':154C 'secur':75C 'skip':4A 'suppli':59B 'tamper':66B 'tool':24B 'use':138C 'valid':50B,117C 'valu':121C 'version':30B 'videollama2':1A,26B,27B,83C 'videollama2/model/__init__.py':100C 'vulner':76C 'yet':155C","nicknames":[],"mitigations":[],"who_affected":"Teams that run VideoLLaMA2 1.1 or earlier and let any outside input influence the model name or path passed to load_pretrained_model. Deployments that load a fixed, locally vetted model directory with no user-controlled path are much less exposed. Teams not using VideoLLaMA2 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116608","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116608","severity":null,"published_at":"2026-10-27T01:19:05+00:00","modified_at":"2026-10-27T01:19:05+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}