CVE-2026-6859

Katalog CVE

CVSS 8.8 · High EPSS 0,77%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada redhat instructlab, redhat enterprise linux ai. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-6859 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2459998 issue tracking · advisory vendor
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6859.json