CVE-2026-124589 | lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0 MoE Shard Checkpoint Loader handle_moe_load_and_save.py load_state_dict_into_model weight_map path traversal (Issue 78)

SecurityVulns
Yanac

A vulnerability was found in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. It has been declared as critical. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal.

This vulnerability is tracked as CVE-2026-124589. The attack can be launched remotely. Moreover, an exploit is present.

This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More