{"id":"CVE-2026-122160","kind":"vulnerability","aliases":["CVE-2026-122160"],"related":[],"title":"AIlice: a downloaded PEFT adapter can silently redirect the model loader to an attacker's base model","description":"A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base_model_name_or_path leads to inclusion of functionality from untrusted control sphere. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"In AIlice up to 0.4.0, LoadModel_PEFT() in ailice/core/llm/AModelCausalLM.py reads base_model_name_or_path from a PEFT adapter's adapter_config.json and fetches that Hugging Face repo with no allowlist or check against the operator-approved model (the approval check runs after the fetch). The reporter's PoC is data-only: no trust_remote_code, pickle or Python file. The attacker's weights and tokenizer produce the agent's responses, which can steer its shell and browser tools. The reporter did not demonstrate direct code execution on the host.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ailice","fixed":[],"affected":"<= 0.4.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","ailice","huggingface","peft","python","untrusted-model"],"not_affected_if":["default-config","hosted-api-models","no-peft-adapters"],"how_to_check":"Run pip show ailice (0.4.0 is the affected version reported). Check config.json for models of type peft in modelList. For each adapter, open adapter_config.json and confirm base_model_name_or_path is the base model you expect. Also check ~/.cache/huggingface for unexpected base model repos.","fix":"No fixed version. The upstream issue #77 (opened 2026-10-13) is still open. Until a fix ships, use only adapters you trust and verify base_model_name_or_path by hand.","status":"open","published_at":"2026-11-05T03:17:21+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","triaged_at":"2026-11-05T03:33:27+00:00","updated_at":"2026-11-05T03:34:42+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-11-05T03:33:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AIlice: model loader lets remote input pull in untrusted code","impact":"high","summary":"AIlice, an AI agent project, has a flaw in its HuggingFace model loader (LoadModel_PEFT) where the base_model_name_or_path argument is not restricted, so it can load functionality from an untrusted source. An attacker who can supply that argument remotely may get code executed on the host running AIlice.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ailice","python","huggingface","ai-agents"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code from an untrusted model source runs on the server","analyst_note":"Confirm whether the remote trigger requires auth or a specific config, and whether the upstream project has released a fix since the NVD entry.","how_to_check":"- Check whether AIlice is installed and which version: `unknown` for the exact command; the affected range is up to and including `0.4.0`.\n- Look at `ailice/core/llm/AModelCausalLM.py` for the `LoadModel_PEFT` function and whether it passes `base_model_name_or_path` through unchecked.\n- Check whether the AIlice service is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running AIlice 0.4.0 or earlier, especially where the model loading path can be reached from outside the machine. The sources say the project has not yet responded to the report, so no fixed version is stated. Installations that do not use the PEFT model loading path, or that restrict who can set the model name, are less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":4302,"output_tokens":627,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the remote trigger requires auth or a specific config, and whether the upstream project has released a fix since the NVD entry.","search":"'-122160':20A,23A '-2026':19A,22A '0.4.0':42B,142C 'adapt':5A,56B 'adapter_config.json':58B 'affect':145C 'agent':27B,107B 'ai':26B,29B,138C 'ai-ag':25B 'ai-tool':28B 'ailic':1A,31B,39B,139C 'ailice':24A 'ailice/core/llm/amodelcausallm.py':46B,153C 'allowlist':67B 'approv':74B,77B 'argument':164C 'attack':14A,100B,185C 'base':16A,48B,165C 'browser':116B 'check':69B,78B 'code':94B,124B 'compon':156C 'control':177C 'cve':18A,21A 'data':89B 'data-on':88B 'demonstr':122B 'detect':134C 'direct':123B 'disclos':191C 'download':3A 'earli':204C 'execut':125B 'exploit':188C 'face':63B 'fetch':60B,82B 'file':98B,152C 'function':147C,174C 'host':128B 'hug':62B 'huggingfac':32B,157C 'inclus':172C 'inform':200C 'initi':183C 'issu':207C 'lead':170C 'loader':11A 'loadmodel':43B,148C 'manipul':161C 'may':194C 'model':10A,17A,37B,49B,75B,158C,166C 'myshel':137C 'myshell-ai':136C 'name':50B,167C 'oper':73B 'operator-approv':72B 'path':52B,169C 'peft':4A,33B,44B,55B,149C 'pickl':95B 'poc':86B 'possibl':181C 'problem':203C 'produc':105B 'project':198C 'public':192C 'python':34B,97B 'read':47B 'redirect':8A 'remot':93B,186C 'repo':64B 'report':84B,119B,208C 'respond':212C 'respons':109B 'run':79B 'secur':130C 'shell':114B 'silent':7A 'sphere':178C 'steer':112B 'token':104B 'tool':30B,117B 'trust':92B 'untrust':36B,176C 'untrusted-model':35B 'use':196C 'vulner':131C,144C 'weight':102B 'wrapper':159C 'yet':213C","nicknames":[],"mitigations":[],"who_affected":"Teams running AIlice 0.4.0 (master at commit 63a22105) that load a PEFT/LoRA adapter (modelType peft) from a shared or downloaded source. An attacker needs the operator to use a malicious adapter; the issue does not describe an unauthenticated network trigger. Setups using hosted API models (OpenAI, Anthropic and similar) or only adapters you built yourself can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ailice"],"ptokens":["ailice"],"labels":["aiagents","ailice","aitooling","high","huggingface","peft","python","untrustedmodel"],"campaign_type":null,"first_public_at":"2026-11-05T03:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122160","severity":null,"published_at":"2026-11-05T03:17:21+00:00","modified_at":"2026-11-05T03:17:21+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","fetched_at":"2026-11-05T03:31:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122160:1747","url":"https://github.com/myshell-ai/AIlice/issues/77","severity":null,"published_at":"2026-11-05T03:34:42+00:00","modified_at":"2026-11-05T03:34:42+00:00","first_seen_at":"2026-11-05T03:34:42+00:00","fetched_at":"2026-11-05T03:34:42+00:00","note":"Read upstream issue AIlice#77 (primary report, open, no maintainer response). The impact is a model redirect through adapter_config.json, not host RCE as the triage summary claimed. It needs an operator to load a malicious adapter. NVD page was not readable, so I did not verify anything. The vuldb CVSS vector says AV:N/PR:N/UI:P, and the HOL record lists 5.3 where we have 7.5. Severity left unchanged.","cites":["https://github.com/myshell-ai/AIlice/issues/77","https://nvd.nist.gov/vuln/detail/CVE-2026-122160"]}],"documents":[{"id":72854,"url":"https://github.com/myshell-ai/AIlice/issues/77","title":"LoadModel_PEFT() loads an attacker-controlled base model named in adapter_config.json (AIlice #77)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":72855,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122160","title":"NVD CVE-2026-122160","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}