CVE-2026-124588 | huggingface finetrainers 0.1.0/0.2.0 Model Index model.py resolve_component_cls library code injection (Issue 435)

November 8, 2026 Yanac

A vulnerability was found in huggingface finetrainers 0.1.0/0.2.0. It has been classified as critical. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection.

This vulnerability is identified as CVE-2026-124588. The attack can be initiated remotely. Additionally, an exploit exists.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More