CVE-2026-124588
Untrusted model metadata could select imports in a finetrainers training job
Hugging Face · finetrainers model index loader
First documented disclosure · Review checkpoint
Summary
A training run could import a local Python module selected by a model’s published metadata.
Severity and exploitation evidence
Medium · 5.3/10 · CVSS 4.0. Severity source.
Exploitation not established: A public researcher report describes a demonstration. The reviewed sources identify no malicious use against a victim.
Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.
How the weakness works
The component resolver accepted the model’s library choice without restricting it to trusted training libraries. Importing a selected module could run its initialization code.
Conditions required
A user starts training against an untrusted local model directory or remote model repository. The effect depends on what can be imported in the training environment.
Potential impact
Code could execute with the training process’s existing permissions. The researcher’s public report concerns model loading.
Affected versions and configurations
The issuing CNA lists 0.1.0 and 0.2.0.
Fix and mitigation status
The reviewed issue and CNA record name no fixed release.
Practical next steps
Use model repositories and metadata from vetted sources, restrict the training worker’s privileges and isolate jobs that accept external models.
Operating lesson
Treat a model’s library selection as executable configuration.
Evidence and limits
The October 17 issue was open with no public maintainer response at review. VulDB published the CVE November 9 and identifies a public proof of concept.