---
id: "CVE-2026-124588"
page: "https://infrastack.ai/live/CVE-2026-124588"
kind: "vulnerability"
aliases: ["CVE-2026-124588"]
title: "finetrainers: a crafted model_index.json can make resolve_component_cls import any module and run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "finetrainers", "fixed": [], "affected": "0.1.0, 0.2.0", "ecosystem": "pypi"}]
ecosystems: []
tags: ["code-execution", "finetrainers", "ml-training", "package", "python", "untrusted-model"]
not_affected_if: ["other-version", "trusted-models-only"]
published_at: "2026-11-09T10:17:09+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:27:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124588", "first_seen_at": "2026-11-09T10:25:49+00:00"}, {"source": "analyst", "url": "https://github.com/huggingface/finetrainers/issues/435", "first_seen_at": "2026-11-09T10:27:00+00:00", "cites": ["https://github.com/huggingface/finetrainers/issues/435"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/huggingface/finetrainers/issues/435"}]
---

# finetrainers: a crafted model_index.json can make resolve_component_cls import any module and run code

Link for people: https://infrastack.ai/live/CVE-2026-124588 (this .md is for agents)

resolve_component_cls() in finetrainers/utils/model.py reads (library, class_name) from a model's model_index.json and passes it to importlib.import_module() and getattr() with no allowlist, so loading an untrusted model directory or Hub repo can import any installed module and run its import-time code. The reporter's PoC (issue #435) uses the stdlib 'this' module as a harmless demonstration. Reporter says it also reaches training runs via _load_transformer_config/_load_vae_config (not verified by us). The issue is open with no maintainer reply, fix or PR. No exploitation in the wild reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:finetrainers affected 0.1.0, 0.2.0 fixed no fixed version listed

## How to check

- pip show finetrainers: 0.1.0 and 0.2.0 are listed; the reporter says the file is identical in the 0.2.0 sdist and on main as of 2026-10-14 (commit 7e9257a, 0.2.0.dev0).
- Check whether you load model_index.json or config.json from models you did not create (Hub repos, shared dirs) via finetrainers.
- Workaround (not from the vendor): only load models you trust, and pin/review model_index.json entries before training. No fixed version exists.

## Fix

No fixed version. Issue #435 is open with no maintainer response.

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124588
- 2026-11-09T10:27:00+00:00 analyst https://github.com/huggingface/finetrainers/issues/435 — Read GitHub issue #435 (reporter's PoC, no maintainer reply, no fix). NVD page and Exa unavailable (NVD page empty, web-cli out of credits); X not checked. Nothing marked verified: source is the reporter's issue, not the vendor. 0.1.0 affected per NVD only; issue confirms 0.2.0.

## Documents

- [poc] finetrainers #435: Arbitrary module import (code execution) from model_index.json in resolve_component_cls https://github.com/huggingface/finetrainers/issues/435

## From the sources

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_