CVE-2026-124588: fallo de gravedad media en huggingface finetrainers
huggingface finetrainers Model Index model.py resolve_component_cls code injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
30Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3
A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
huggingface · finetrainersPoCs públicas encontradas — 1
cve_referencegithub.com/user-attachments/files/33587108/poc.zipno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.