{"id":"CVE-2026-124588","kind":"vulnerability","aliases":["CVE-2026-124588"],"related":[],"title":"finetrainers: a crafted model_index.json can make resolve_component_cls import any module and run code","description":"A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"resolve_component_cls() in finetrainers/utils/model.py reads (library, class_name) from a model's model_index.json and passes it to importlib.import_module() and getattr() with no allowlist, so loading an untrusted model directory or Hub repo can import any installed module and run its import-time code. The reporter's PoC (issue #435) uses the stdlib 'this' module as a harmless demonstration. Reporter says it also reaches training runs via _load_transformer_config/_load_vae_config (not verified by us). The issue is open with no maintainer reply, fix or PR. No exploitation in the wild reported.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"finetrainers","fixed":[],"affected":"0.1.0, 0.2.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["code-execution","finetrainers","ml-training","package","python","untrusted-model"],"not_affected_if":["other-version","trusted-models-only"],"how_to_check":"- pip show finetrainers: 0.1.0 and 0.2.0 are listed; the reporter says the file is identical in the 0.2.0 sdist and on main as of 2026-10-14 (commit 7e9257a, 0.2.0.dev0).\n- Check whether you load model_index.json or config.json from models you did not create (Hub repos, shared dirs) via finetrainers.\n- Workaround (not from the vendor): only load models you trust, and pin/review model_index.json entries before training. No fixed version exists.","fix":"No fixed version. Issue #435 is open with no maintainer response.","status":"open","published_at":"2026-11-09T10:17:09+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:06+00:00","updated_at":"2026-11-09T10:27:00+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-09T10:26:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"finetrainers: model index handling lets remote attackers inject code","impact":"high","summary":"finetrainers 0.1.0 and 0.2.0 fail to validate the Library argument in resolve_component_cls, so a crafted model index can inject code. The exploit is public, and the project has not responded to the report.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","finetrainers","ml-training"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"code injection runs attacker commands on the training machine","analyst_note":"Confirm the affected load path and whether any fixed version or workaround exists; the project has not responded, so check the NVD entry and the project's issue tracker.","how_to_check":"- Check the installed version: `pip show finetrainers` and confirm whether it is `0.1.0` or `0.2.0`.\n- Look for calls to `resolve_component_cls` in `finetrainers/utils/model.py` that load model index data from untrusted sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-version","trusted-models-only"],"who_is_affected":"Teams that load model index data into finetrainers 0.1.0 or 0.2.0, especially from sources outside their control, are exposed through the Library argument. Teams that do not use these versions or only load trusted local models can skip it. The sources do not state a fixed version and the project has not responded.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4596,"output_tokens":561,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected load path and whether any fixed version or workaround exists; the project has not responded, so check the NVD entry and the project's issue tracker.","search":"'-124588':18A,21A '-2026':17A,20A '/0.2.0':138C '0.1.0':137C '435':86B 'allowlist':59B 'also':99B 'argument':163C 'attack':170C,188C 'class':42B 'cls':9A,37B,147C 'code':15A,24B,80B,167C 'code-execut':23B 'compon':8A,36B,146C,154C 'config/_load_vae_config':106B 'craft':3A 'cve':16A,19A 'demonstr':95B 'directori':65B 'discov':133C 'earli':196C 'element':141C 'execut':25B 'exploit':123B,176C 'file':150C 'finetrain':1A,26B,136C 'finetrainers':22A 'finetrainers/utils/model.py':39B,151C 'fix':119B 'flaw':130C 'function':144C 'getattr':56B 'handler':157C 'harmless':94B 'hub':67B 'huggingfac':135C 'impact':140C 'import':10A,70B,78B 'import-tim':77B 'importlib.import':53B 'index':156C 'inform':192C 'initi':173C 'inject':168C 'instal':72B 'issu':85B,112B,199C 'librari':41B,164C 'load':61B,104B 'maintain':117B 'make':6A 'manipul':160C 'may':184C 'ml':28B 'ml-train':27B 'model':34B,46B,64B,155C 'model_index.json':4A,48B 'modul':12A,54B,73B,91B 'name':43B 'open':114B 'packag':30B 'pass':50B 'perform':158C 'poc':84B 'pr':121B 'problem':195C 'project':190C 'public':182C 'python':31B 'reach':100B 'read':40B 'releas':179C 'remot':174C 'repli':118B 'repo':68B 'report':82B,96B,127B,200C 'resolv':7A,35B,145C 'respond':204C 'result':165C 'run':14A,75B,102B 'say':97B 'secur':129C 'stdlib':89B 'time':79B 'train':29B,101B 'transform':105B 'untrust':33B,63B 'untrusted-model':32B 'us':110B 'use':87B,186C 'verifi':108B 'via':103B 'wild':126B 'yet':205C","nicknames":[],"mitigations":[],"who_affected":"Teams that load model index data into finetrainers 0.1.0 or 0.2.0, especially from sources outside their control, are exposed through the Library argument. Teams that do not use these versions or only load trusted local models can skip it. The sources do not state a fixed version and the project has not responded.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["finetrainers"],"ptokens":["finetrainers"],"labels":["codeexecution","finetrainers","high","mltraining","package","python","untrustedmodel"],"campaign_type":null,"search_a":"'-124588':18A,21A '-2026':17A,20A 'cls':9A 'code':15A 'compon':8A 'craft':3A 'cve':16A,19A 'finetrain':1A 'finetrainers':22A 'import':10A 'make':6A 'model_index.json':4A 'modul':12A 'resolv':7A 'run':14A","search_b":"'435':86B 'allowlist':59B 'also':99B 'class':42B 'cls':37B 'code':24B,80B 'code-execut':23B 'compon':36B 'config/_load_vae_config':106B 'demonstr':95B 'directori':65B 'execut':25B 'exploit':123B 'finetrain':26B 'finetrainers/utils/model.py':39B 'fix':119B 'getattr':56B 'harmless':94B 'hub':67B 'import':70B,78B 'import-tim':77B 'importlib.import':53B 'instal':72B 'issu':85B,112B 'librari':41B 'load':61B,104B 'maintain':117B 'ml':28B 'ml-train':27B 'model':34B,46B,64B 'model_index.json':48B 'modul':54B,73B,91B 'name':43B 'open':114B 'packag':30B 'pass':50B 'poc':84B 'pr':121B 'python':31B 'reach':100B 'read':40B 'repli':118B 'repo':68B 'report':82B,96B,127B 'resolv':35B 'run':75B,102B 'say':97B 'stdlib':89B 'time':79B 'train':29B,101B 'transform':105B 'untrust':33B,63B 'untrusted-model':32B 'us':110B 'use':87B 'verifi':108B 'via':103B 'wild':126B","search_c":"'/0.2.0':138C '0.1.0':137C 'argument':163C 'attack':170C,188C 'cls':147C 'code':167C 'compon':146C,154C 'discov':133C 'earli':196C 'element':141C 'exploit':176C 'file':150C 'finetrain':136C 'finetrainers/utils/model.py':151C 'flaw':130C 'function':144C 'handler':157C 'huggingfac':135C 'impact':140C 'index':156C 'inform':192C 'initi':173C 'inject':168C 'issu':199C 'librari':164C 'manipul':160C 'may':184C 'model':155C 'perform':158C 'problem':195C 'project':190C 'public':182C 'releas':179C 'remot':174C 'report':200C 'resolv':145C 'respond':204C 'result':165C 'secur':129C 'use':186C 'yet':205C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-124588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124588","severity":null,"published_at":"2026-11-09T10:17:09+00:00","modified_at":"2026-11-09T10:17:09+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124588:2267","url":"https://github.com/huggingface/finetrainers/issues/435","severity":null,"published_at":"2026-11-09T10:27:00+00:00","modified_at":"2026-11-09T10:27:00+00:00","first_seen_at":"2026-11-09T10:27:00+00:00","fetched_at":"2026-11-09T10:27:00+00:00","note":"Read GitHub issue #435 (reporter's PoC, no maintainer reply, no fix). NVD page and Exa unavailable (NVD page empty, web-cli out of credits); X not checked. Nothing marked verified: source is the reporter's issue, not the vendor. 0.1.0 affected per NVD only; issue confirms 0.2.0.","cites":["https://github.com/huggingface/finetrainers/issues/435"]}],"documents":[{"id":106979,"url":"https://github.com/huggingface/finetrainers/issues/435","title":"finetrainers #435: Arbitrary module import (code execution) from model_index.json in resolve_component_cls","kind":"issue","source":"analyst","publisher":null,"text":"Open issue by 3em0 (Oct 17 2026). resolve_component_cls() in finetrainers/utils/model.py reads model_index.json and passes (library, class_name) to importlib.import_module()/getattr() without restriction. PoC: maps transformer to [\"this\",\"s\"], importing stdlib 'this' as a side effect. Present in commit 7e9257a (0.2.0.dev0), identical in PyPI 0.2.0 sdist, on main HEAD as of 2026-10-14 per reporter. No maintainer reply, no fix, no linked PR.","published_at":null,"relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://github.com/huggingface/finetrainers/issues/435"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}