SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-86169

HIGH · CVSS 8.8 EPSS 0.49% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-05 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

A remote code execution vulnerability exists in Axolotl versions up to 0.18.0, allowing attackers to bypass security measures and execute arbitrary Python code by manipulating the base_model parameter in a malicious Hugging Face model repository. This flaw arises from the incorrect default setting of trust_remote_code, which defaults to None instead of False. Organizations using Axolotl for model deployment should prioritize patching this vulnerability to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-86169
Severity
HIGH
CVSS
8.8
EPSS
0.49%

Original NVD Description

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.