FINETRAINERS · CVE-2026-124588 · Package
NO FIX YET · SEE WHAT TO DO
resolve_component_cls() in finetrainers/utils/model.py reads (library, class_name) from a model's model_index.json and passes it to importlib.import_module() and getattr() with no allowlist, so loading an untrusted model directory or Hub repo can import any installed module and run its import-time code. The reporter's PoC (issue #435) uses the stdlib 'this' module as a harmless demonstration. Reporter says it also reaches training runs via _load_transformer_config/_load_vae_config (not verified by us). The issue is open with no maintainer reply, fix or PR. No exploitation in the wild reported.
first public Nov 9, 2026 · 1 public exploit · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that load model index data into finetrainers 0.1.0 or 0.2.0, especially from sources outside their control, are exposed through the Library argument. Teams that do not use these versions or only load trusted local models can skip it. The sources do not state a fixed version and the project has not responded.
Not affected if other-version, trusted-models-only
Who cares code-execution, finetrainers, ml-training, python, untrusted-model
A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.