Loading story…
OpenMed versions before 1.5.2 contain a critical remote code execution flaw, tracked as CVE-2026-47117, in the PII privacy-filter model loading path. The vulnerability is caused by broad substring matching on the user-controlled model_name parameter, which can misroute attacker-supplied values into a Hugging Face loading path with trust_remote_code=True. An unauthenticated attacker can point OpenMed to a malicious model repository that defines custom Transformers code through auto_map in config.json or tokenizer_config.json, causing that code to be imported and executed with the privileges of the OpenMed service process.
The OpenMed project released version 1.5.2 to fix the issue by separating model routing from trust decisions, making trust_remote_code default to False in PrivacyFilterTorchPipeline, and limiting trusted remote-code loading to an explicit allowlist of first-party or operator-approved repositories. The release also introduced the OPENMED_TRUSTED_REMOTE_CODE_MODELS environment variable for controlled private fine-tunes, while pull request #59 added stricter identifier matching, gated remote-code dispatch, and security regression tests. The CVE is classified as CWE-94 and carries a critical CVSS 3.1 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-02, a CVE entry and advisory documented a critical remote code execution vulnerability in OpenMed versions before 1.5.2. The flaw stems from broad substring matching on a user-controlled model_name value that can route attacker-supplied Hugging Face repositories into a trust_remote_code-enabled loading path.
The CVE record states that disclosure for CVE-2026-47117 was received by disclosure@vulncheck.com on 2026-06-02. The issue affects OpenMed versions before 1.5.2 and allows unauthenticated remote code execution through the PII privacy-filter model loading path.
On 2026-05-27, OpenMed released version 1.5.2 as a security-focused update addressing a trust-boundary weakness in the privacy-filter model-loading path. The release separated model routing from trust decisions, defaulted trust_remote_code to false, and limited trusted remote-code loading to an explicit allowlist or operator-approved models.
On 2026-05-27, pull request #59 was merged into the OpenMed master branch after 13 checks passed. The changes restricted identifier matching, gated remote-code dispatch, added security regression tests, and documented the security hardening for version 1.5.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-68770** affects Hugging Face's `sentence-transformers` package and allows **arbitrary code execution** when a model is loaded from a local path, even if applications explicitly set `trust_remote_code=False`. The flaw stems from a logic error in the `import_module_class` helper in `sentence_transformers/util/misc.py`, where an `or os.path.exists(model_name_or_path)` condition accepts existing local filesystem paths and can cause malicious Python code referenced through `modules.json` to run during import. The issue is classified as **CWE-94** and carries a **CVSS 3.1 score of 9.8**, with high impact to confidentiality, integrity, and availability. The bug affects `sentence-transformers` through **version 5.5.1** and creates a significant AI/ML supply-chain risk for organizations that load models from disk or from directories an attacker can influence. Reporting indicates no active exploitation had been confirmed at publication, but maintainers have released a fix, with coverage pointing to **version 5.6.1** as the remediated release. Organizations using local model-loading workflows are being urged to upgrade immediately and tighten controls around model directories, stored artifacts, and any process that imports untrusted model content.
Aug 1, 2026
A critical remote code execution vulnerability, tracked as **`CVE-2026-58116`**, affects **LLaMA-Factory** through version **0.9.5**. The flaw is in the WebUI **Chat** and **Training** interfaces, where user-supplied **Model path** input is passed to Hugging Face model-loading functions with **`trust_remote_code=True`**, allowing attacker-controlled code from a remote or local model repository to run with the privileges of the server process. Public reporting said the issue is remotely exploitable and carries a **CVSS 3.1 score of 9.8** and **CVSS 4.0 score of 9.3**. The vulnerability was publicly described as a model path injection issue that can be triggered by pointing the WebUI at a malicious Hugging Face repository containing crafted Python files executed during model loading. Reports said there is no UI option or configuration setting to disable the unsafe behavior in affected versions, expanding exposure across both interfaces. Recommended mitigations include updating LLaMA-Factory, sanitizing model path input, disabling **`trust_remote_code`** where possible, and restricting WebUI access to authorized users only.
Jun 30, 2026
A critical remote code execution flaw in Hugging Face's `transformers` library allowed attacker-controlled model repositories to run arbitrary code during the standard `from_pretrained()` loading process, even when `trust_remote_code=False` was set. The issue was tied to unsafe handling of untrusted model configuration data, including nested configuration resolution in the LightGlue loading path, where values from `config.json` could override the intended safety setting and trigger execution of attacker-supplied Python modules during model initialization. Reports said the vulnerability affected `transformers` versions `4.56.0` through `5.2.x` in environments where the `kernels` package was installed, with version `5.2.0` specifically cited in LightGlue-related exploitation scenarios. Exposed targets included inference servers, research notebooks, CI/CD pipelines, and automated model evaluation systems, where successful compromise could enable theft of cloud credentials, API keys, SSH keys, proprietary datasets, lateral movement, persistence, and backdoor deployment. Hugging Face released a fix in `transformers` `5.3.0` and urged organizations to upgrade and treat model loading as a code execution surface.
Jun 29, 2026