CVE-2026-122160

An AIlice adapter can substitute an unapproved base model

MyShell · AIlice PEFT model loader

First documented disclosure · Review checkpoint

Summary

An adapter can silently select the weights and tokenizer that will generate the agent’s replies.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher compared inert adapters against a controlled Hub and observed different base models. No malicious use was reported.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The loader resolves the base repository named in the adapter before checking the configured model list. The base repository is not independently authorized.

Conditions required

The operator loads an untrusted adapter, and the named base model can be retrieved from the configured Hub or cache.

Potential impact

Attacker-selected weights can alter replies and influence an agent that acts on those replies. Executing Python supplied by the model was not required or demonstrated.

Affected versions and configurations

VulDB lists versions through 0.4.0. The researcher tested that version at 63a22105cdf8.

Fix and mitigation status

No issue-specific fixed release was verified.

Practical next steps

Require a pinned, approved base model and tokenizer for each adapter. Check the reference before permitting downloads.

Operating lesson

Approving an adapter should also establish which base weights it may select.

Evidence and limits

October 13 is the public researcher report. VulDB published the CVE November 5. Downstream tool effects depend on the tools and permissions an installation grants.

Sources