CVE-2026-86169

Remote code execution via malicious Hugging Face model due to trust_remote_code defaulting to None.

• CVSS 8.7
• 829
• Design Defects
• Remote

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.

CVE

CVE-2026-86169

CWE

829

CVSS base score

8.7

Published

2026-09-05

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Transformers

Fixed by upgrading

Yes

Solution

Upgrade Axolotl to version 0.19.0 or newer, where the trust_remote_code default is fixed.

from transformers import AutoModelForCausalLM

def load_model(base_model: str):
    """
    Load a causal language model from a Hugging Face repository.
    """
    # VULNERABLE: trust_remote_code defaults to None, bypassing security guard
    model = AutoModelForCausalLM.from_pretrained(base_model, trust_remote_code=None)
    return model

from transformers import AutoModelForCausalLM

def load_model(base_model: str):
    """
    Load a causal language model from a Hugging Face repository.
    """
    # FIX: explicitly disable remote code execution
    model = AutoModelForCausalLM.from_pretrained(base_model, trust_remote_code=False)
    return model

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202686169,
  title        = {{Remote code execution via malicious Hugging Face model due to trust_remote_code defaulting to None.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-86169},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-86169/}}
}