CVE-2026-31228

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval() function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without any sanitization or security restrictions. An attacker can exploit this by providing a specially crafted string that contains arbitrary Python code, which will be executed when eval() is called, leading to complete compromise of the system running the ART evaluation.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Trusted-AI/adversarial-robustness-toolbox
https://www.notion.so/CVE-2026-31228-35d1e1393188817f9ab0dc4b1651dfe9
https://access.redhat.com/security/cve/CVE-2026-31228
https://bugzilla.redhat.com/show_bug.cgi?id=2476522
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31228.json

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) La Adversarial Robustness Toolbox (ART) hasta la versión 1.20.1 contiene una vulnerabilidad de ejecución remota de código en su componente Kubeflow. La función de evaluación de robustez para modelos PyTorch utiliza la función insegura eval() para evaluar dinámicamente cadenas proporcionadas por el usuario para los parámetros LossFn y Optimizer sin ninguna sanitización o restricciones de seguridad. Un atacante puede explotar esto al proporcionar una cadena especialmente diseñada que contiene código Python arbitrario, el cual se ejecutará cuando se llame a eval(), lo que lleva a un compromiso completo del sistema que ejecuta la evaluación de ART.

Information

Published : 2026-05-12 16:16

Updated : 2026-10-19 22:10

NVD link : CVE-2026-31228

Mitre link : CVE-2026-31228

CVE.ORG link : CVE-2026-31228

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-31228", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31228", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-13T14:09:43.765461Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kserve-agent-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kserve-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kserve-router-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-kserve-storage-initializer-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-12T16:16:14.633", "references": [{"url": "https://github.com/Trusted-AI/adversarial-robustness-toolbox", "source": "cve@mitre.org"}, {"url": "https://www.notion.so/CVE-2026-31228-35d1e1393188817f9ab0dc4b1651dfe9", "source": "cve@mitre.org"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-31228", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476522", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31228.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval() function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without any sanitization or security restrictions. An attacker can exploit this by providing a specially crafted string that contains arbitrary Python code, which will be executed when eval() is called, leading to complete compromise of the system running the ART evaluation."}, {"lang": "es", "value": "La Adversarial Robustness Toolbox (ART) hasta la versi\u00f3n 1.20.1 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en su componente Kubeflow. La funci\u00f3n de evaluaci\u00f3n de robustez para modelos PyTorch utiliza la funci\u00f3n insegura eval() para evaluar din\u00e1micamente cadenas proporcionadas por el usuario para los par\u00e1metros LossFn y Optimizer sin ninguna sanitizaci\u00f3n o restricciones de seguridad. Un atacante puede explotar esto al proporcionar una cadena especialmente dise\u00f1ada que contiene c\u00f3digo Python arbitrario, el cual se ejecutar\u00e1 cuando se llame a eval(), lo que lleva a un compromiso completo del sistema que ejecuta la evaluaci\u00f3n de ART."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "cve@mitre.org"}