Executive brief
InstructLab, a tool used for training and interacting with large language models, contains a security flaw that could allow an attacker to take over a user's system. By tricking a user into downloading or training a malicious model from the HuggingFace Hub, an attacker can execute unauthorized commands on the victim's computer. This could lead to the theft of sensitive data or a complete compromise of the affected machine.
Technical details
A vulnerability exists in InstructLab's `linux_train.py` script where the `trust_remote_code=True` parameter is hardcoded during HuggingFace `from_pretrained()` calls. This bypasses security protections that normally prevent the execution of arbitrary code embedded within model files. A remote attacker can exploit this by hosting a malicious model on the HuggingFace Hub and convincing a user to interact with it using `ilab` commands (train, download, or generate). Successful exploitation results in arbitrary Python code execution with the privileges of the user running the script, potentially leading to full system compromise.
Affected products
- Red Hat InstructLab -
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 3.0
Timeline
- 2026-04-15: advisory: Initial release date of the VEX document
- 2026-04-22: disclosed: NVD publication date