CVE-2026-84452

{"id": "CVE-2026-84452", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84452", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-03T16:01:21.102609Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "winml-cli", "versions": [{"status": "affected", "version": "< 0.4.0"}]}]}], "published": "2026-09-02T20:17:41.350", "references": [{"url": "https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/winml-cli/pull/1321", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0."}, {"lang": "es", "value": "Windows ML CLI es una herramienta de l\u00ednea de comandos para construir modelos de IA port\u00e1tiles, de alto rendimiento y de alta calidad para Windows ML. Antes de la versi\u00f3n 0.4.0, el componente src/winml/modelkit/serve/cli_api.py expone comandos de WinML CLI a trav\u00e9s de una API HTTP de localhost sin autenticaci\u00f3n y configura la opci\u00f3n allow_origins como un comod\u00edn tanto en src/winml/modelkit/serve/cli_api.py como en src/winml/modelkit/serve/app.py. Un sitio web malicioso cargado por un usuario puede enviar solicitudes de origen cruzado a /v1/cli/build o /v1/cli/config y establecer el par\u00e1metro trust_remote_code en true, lo que se convierte en el indicador de l\u00ednea de comandos --trust-remote-code sin validaci\u00f3n. Esto llega a AutoConfig.from_pretrained con trust_remote_code=True en src/winml/modelkit/loader/_autoconfig.py e importa c\u00f3digo Python desde un repositorio de modelos controlado por un atacante, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario como el usuario del servidor. Este problema est\u00e1 solucionado en la versi\u00f3n 0.4.0."}], "lastModified": "2026-09-28T23:10:00.143", "sourceIdentifier": "security-advisories@github.com"}