# CVE-2026-124588: Hugging Face finetrainers code injection in model index handler

Source: https://junglewise.ai/threats/cve-2026-124588-a-security-flaw-has-been-discovered-in-huggingface-finetrainers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124588 · Severity: medium · CVSS 6.3 · Published 2026-11-09

Hugging Face finetrainers is a library for training diffusion models. A code injection vulnerability in the model index handler allows remote attackers to execute arbitrary Python code by crafting a malicious model package with a specially modified model_index.json file. An attacker can achieve full code execution on a training host simply by hosting or distributing a trojanized model package.

Vendors: [Hugging Face](https://junglewise.ai/threats/vendors/hugging-face).

## Quick answers

**Is CVE-2026-124588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124588 being exploited in the wild.

**How severe is CVE-2026-124588?** Medium severity, with a CVSS score of 6.3, published 9 November 2026.

**Which products and versions are affected?** Hugging Face Finetrainers 0.1.0, 0.2.0.

**Is there a fix for CVE-2026-124588?** No fixed version is recorded yet. Restrict model loading to trusted sources only; do not load model packages from untrusted repositories or user-supplied directories without sandboxing or validation. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-124588 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-124588?** Check whether you run Hugging Face Finetrainers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict model loading to trusted sources only; do not load model packages from untrusted repositories or user-supplied directories without sandboxing or validation.

## Technical details

The resolve_component_cls() function in finetrainers/utils/model.py unsafely parses model_index.json and passes the library name directly to importlib.import_module() without validation, allowing arbitrary module imports. When resolve_component_cls is called during model loading (e.g., via _load_transformer_config with an untrusted model package), an attacker can specify any installed Python module to be imported, causing import-time code execution. No authentication or special privileges are required; the attack is triggered whenever finetrainers loads a malicious model from an untrusted source.

## Affected products

- Hugging Face finetrainers 0.1.0, 0.2.0

## Timeline

- 2026-11-09: disclosed
- 2026-10-17: exploited: Public issue report filed; exploit PoC released

## References

- [https://github.com/huggingface/finetrainers/](https://github.com/huggingface/finetrainers/)
- [https://github.com/huggingface/finetrainers/issues/435](https://github.com/huggingface/finetrainers/issues/435)