Is CVE-2026-124588 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124588 being exploited in the wild.

How severe is CVE-2026-124588?

Medium severity, with a CVSS score of 6.3, published 9 November 2026.

Which products and versions are affected?

Hugging Face Finetrainers 0.1.0, 0.2.0.

How is CVE-2026-124588 attacked?

It is attacked over the network.

Am I affected by CVE-2026-124588?

Check whether you run Hugging Face Finetrainers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124588: Hugging Face finetrainers code injection in model index handler

CVE-2026-124588 · Severity: medium · CVSS 6.3 · Published 2026-11-09

Hugging Face finetrainers is a library for training diffusion models. A code injection vulnerability in the model index handler allows remote attackers to execute arbitrary Python code by crafting a malicious model package with a specially modified model_index.json file. An attacker can achieve full code execution on a training host simply by hosting or distributing a trojanized model package.

Vendors: Hugging Face.

Quick answers

Is CVE-2026-124588 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124588 being exploited in the wild.
How severe is CVE-2026-124588?: Medium severity, with a CVSS score of 6.3, published 9 November 2026.
Which products and versions are affected?: Hugging Face Finetrainers 0.1.0, 0.2.0.
Is there a fix for CVE-2026-124588?: No fixed version is recorded yet. Restrict model loading to trusted sources only; do not load model packages from untrusted repositories or user-supplied directories without sandboxing or validation. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-124588 attacked?: It is attacked over the network.
Am I affected by CVE-2026-124588?: Check whether you run Hugging Face Finetrainers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict model loading to trusted sources only; do not load model packages from untrusted repositories or user-supplied directories without sandboxing or validation.

Technical details

The resolve_component_cls() function in finetrainers/utils/model.py unsafely parses model_index.json and passes the library name directly to importlib.import_module() without validation, allowing arbitrary module imports. When resolve_component_cls is called during model loading (e.g., via _load_transformer_config with an untrusted model package), an attacker can specify any installed Python module to be imported, causing import-time code execution. No authentication or special privileges are required; the attack is triggered whenever finetrainers loads a malicious model from an untrusted source.

Affected products

Hugging Face finetrainers 0.1.0, 0.2.0

Timeline

2026-11-09: disclosed
2026-10-17: exploited: Public issue report filed; exploit PoC released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.