BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-122160myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphere

A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base_model_name_or_path leads to inclusion of functionality from untrusted control sphere. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

5.3 MEDIUMEPSS 0.31%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
5.3MEDIUM4.0VulDB (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2.1LOW4.0VulDB (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6.3MEDIUM3.1VulDB (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
6.3MEDIUM3.1VulDB (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RC:C
6.3MEDIUM3.0VulDB (CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RC:C
7.5HIGH2.0VulDB (CNA)AV:N/AC:L/Au:N/C:P/I:P/A:P
7.5HIGH2.0VulDB (CNA)AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C

Details

CVE ID
CVE-2026-122160
Status
Deferred
Assigner (CNA)
VulDB
Published
Nov 5, 2026
Last modified
2026-11-05 21:18 UTC
Weaknesses
  • CWE-829 · Inclusion of Functionality from Untrusted Control Sphere

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 09:20 UTC.