Executive brief
OpenMed, a library used for medical data processing, is vulnerable to a critical security flaw in its privacy-filtering component. An attacker can trick the system into loading a malicious AI model from a remote source, allowing them to execute arbitrary code on the server. This could lead to a complete system takeover, unauthorized access to sensitive medical data, and disruption of services.
Technical details
A remote code execution (RCE) vulnerability exists in OpenMed's PII privacy-filter dispatcher due to broad substring matching on the user-supplied `model_name` parameter. This flaw allows an unauthenticated attacker to bypass intended restrictions and route requests to a path that loads Hugging Face models with `trust_remote_code=True`. By supplying a malicious model repository containing custom Transformers code (via `auto_map` in `config.json` or `tokenizer_config.json`), the attacker can achieve arbitrary code execution with the privileges of the OpenMed service process. The issue is addressed in version 1.5.2.
Affected products
- maziyarpanahi openmed < 1.5.2
Timeline
- 2026-06-02: advisory
- 2026-06-02: disclosed
- 2026-06-30: patched: GitHub advisory reviewed and patch confirmed.