https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 14:52:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337161 EUVD-2026-337161 https://cve.radiocsirt.org/vuln/euvd-2026-337161 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6859 <p>A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.</p> <p>A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6859 https://cve.radiocsirt.org/vuln/ghsa-rxpq-xgqx-fr7p <p><strong>Affected:</strong> PyPI: instructlab</p> <p>A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.</p> <p><strong>Affected:</strong> PyPI: instructlab</p> <p>A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.</p> https://cve.radiocsirt.org/vuln/ghsa-rxpq-xgqx-fr7p https://cve.radiocsirt.org/vuln/pysec-2026-2522 <p><strong>Affected:</strong> PyPI: instructlab</p> <p>A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.</p> <p><strong>Affected:</strong> PyPI: instructlab</p> <p>A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2522