Executive brief
TinyZero, an open-source project for reproducing AI models, contains a critical security flaw in how it handles file operations. An attacker can use specially crafted file paths to take control of the system running the software. This could lead to a complete system takeover, theft of sensitive AI training data, or disruption of research operations.
Technical details
A command injection vulnerability (CWE-78) exists in TinyZero's HDFS file operation utilities through commit 6652a63. The root cause is the use of Python's os.system() function within the _copy() function, where user-controlled file paths are directly interpolated into shell command strings using f-strings without sanitization. An attacker can exploit this by supplying a crafted path parameter via the Hydra configuration framework. This allows for arbitrary OS command execution with the privileges of the user running the TinyZero training process. The vulnerability is reachable over the network if the configuration framework is exposed or accepts external input.
Affected products
- Jiayi-Pan TinyZero up to commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839
Timeline
- 2026-05-12: advisory: Initial disclosure of CVE-2026-31226
- 2026-05-13: other: CISA-ADP enrichment added CVSS and CWE data