Is CVE-2026-31217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-31217 being exploited in the wild.

How severe is CVE-2026-31217?

Critical severity, with a CVSS score of 9.8, published 12 May 2026.

Which products and versions are affected?

Nebuly AI Optimate commit a6d302f912b481c94370811af6b11402f51d377f.

Is there a fix for CVE-2026-31217?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-31217 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-31217?

Check whether you run Nebuly AI Optimate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-31217: Nebuly AI Optimate arbitrary code execution in neural_magic_training.py

CVE-2026-31217 · Severity: critical · CVSS 9.8 · Published 2026-05-12

Nebuly AI Optimate is a collection of libraries used to optimize the performance of AI models. A security vulnerability in its training script allows the software to execute arbitrary, potentially malicious code when loading a model from a user-specified directory. An attacker could exploit this to take full control of the system running the optimization process, leading to data theft or unauthorized access to infrastructure.

Technologies: Nebuly AI Optimate. Vendors: Nebuly AI.

Quick answers

Is CVE-2026-31217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-31217 being exploited in the wild.
How severe is CVE-2026-31217?: Critical severity, with a CVSS score of 9.8, published 12 May 2026.
Which products and versions are affected?: Nebuly AI Optimate commit a6d302f912b481c94370811af6b11402f51d377f.
Is there a fix for CVE-2026-31217?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-31217 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-31217?: Check whether you run Nebuly AI Optimate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in the _load_model() function within neural_magic_training.py of the Optimate project. The vulnerability is triggered when a user provides a directory path via the --model command-line argument. The script reads a file named module.py from the specified directory and executes its content using Python's exec() function without any validation or sanitization. An attacker who can influence the input directory path or place a malicious module.py file in a targeted directory can achieve arbitrary code execution in the context of the script's process. This issue was identified in commit a6d302f912b481c94370811af6b11402f51d377f.

Affected products

Nebuly AI optimate commit a6d302f912b481c94370811af6b11402f51d377f

Timeline

2026-05-12: advisory: Initial disclosure of CVE-2026-31217

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.