CVE-2026-6859
published 2026-04-22CVE-2026-6859: A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote…
PriorityP355high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.44%
36.8th percentile
A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux_ai | — | — |
| rhelai3 | bootc-aws-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-cuda-rhel9 | — | — |
| rhelai3 | bootc-azure-rocm-rhel9 | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gcp-cuda-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
InstructLab Includes Functionality from Untrusted Control Sphere
ghsa·2026-04-22
CVE-2026-6859 [HIGH] CWE-829 InstructLab Includes Functionality from Untrusted Control Sphere
InstructLab Includes Functionality from Untrusted Control Sphere
A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.
GHSA
GHSA-rxpq-xgqx-fr7p: A flaw was found in InstructLab
ghsa_unreviewed·2026-04-22
CVE-2026-6859 [HIGH] CWE-829 GHSA-rxpq-xgqx-fr7p: A flaw was found in InstructLab
A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.
Red Hat
instructlab: InstructLab: Arbitrary code execution due to hardcoded `trust_remote_code=True`
vendor_redhat·2026-04-15·CVSS 8.8
CVE-2026-6859 [HIGH] CWE-829 instructlab: InstructLab: Arbitrary code execution due to hardcoded `trust_remote_code=True`
instructlab: InstructLab: Arbitrary code execution due to hardcoded `trust_remote_code=True`
A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.
Statement: Important: InstructLab in Red Hat Enterprise Linux AI is vulnerable to remote code execution. The application hardcodes `trust_remote_code=True` when loading HuggingFace models, allowing an attacker to execute arbitrary Python code if a user runs `ilab train/download/generate` with a malicious model f
No detection rules found.
No public exploits indexed.
2026-04-22
Published