---
id: "CVE-2026-122160"
kind: "vulnerability"
aliases: ["CVE-2026-122160"]
title: "AIlice: a downloaded PEFT adapter can silently redirect the model loader to an attacker's base model"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "ailice", "fixed": [], "affected": "<= 0.4.0", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-agents", "ai-tooling", "ailice", "huggingface", "peft", "python", "untrusted-model"]
not_affected_if: ["default-config", "hosted-api-models", "no-peft-adapters"]
published_at: "2026-11-05T03:17:21+00:00"
first_seen_at: "2026-11-05T03:31:40+00:00"
updated_at: "2026-11-05T03:34:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122160", "first_seen_at": "2026-11-05T03:31:40+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122160", "first_seen_at": "2026-11-05T03:34:42+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-122160", "https://github.com/myshell-ai/AIlice/issues/77"]}]
exploit_sources: []
---

# AIlice: a downloaded PEFT adapter can silently redirect the model loader to an attacker's base model

In AIlice up to 0.4.0, LoadModel_PEFT() in ailice/core/llm/AModelCausalLM.py reads base_model_name_or_path from a PEFT adapter's adapter_config.json and fetches that Hugging Face repo with no allowlist or check against the operator-approved model (the approval check runs after the fetch). The reporter's PoC is data-only: no trust_remote_code, pickle or Python file. The attacker's weights and tokenizer produce the agent's responses, which can steer its shell and browser tools. The reporter did not demonstrate direct code execution on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:ailice affected <= 0.4.0 fixed no fixed version listed

## How to check

Run pip show ailice (0.4.0 is the affected version reported). Check config.json for models of type peft in modelList. For each adapter, open adapter_config.json and confirm base_model_name_or_path is the base model you expect. Also check ~/.cache/huggingface for unexpected base model repos.

## Fix

No fixed version. The upstream issue #77 (opened 2026-10-13) is still open. Until a fix ships, use only adapters you trust and verify base_model_name_or_path by hand.

## Timeline

- 2026-11-05T03:31:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122160
- 2026-11-05T03:34:42+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-122160 — Read upstream issue AIlice#77 (primary report, open, no maintainer response). The impact is a model redirect through adapter_config.json, not host RCE as the triage summary claimed. It needs an operator to load a malicious adapter. NVD page was not readable, so I did not verify anything. The vuldb CVSS vector says AV:N/PR:N/UI:P, and the HOL record lists 5.3 where we have 7.5. Severity left unchanged.

## Documents

- [advisory] NVD CVE-2026-122160 https://nvd.nist.gov/vuln/detail/CVE-2026-122160
- [describes] LoadModel_PEFT() loads an attacker-controlled base model named in adapter_config.json (AIlice #77) https://github.com/myshell-ai/AIlice/issues/77

## From the sources

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base_model_name_or_path leads to inclusion of functionality from untrusted control sphere. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_