Executive brief
X-AnyLabeling is a desktop application for annotating images, videos, and other data using AI models. The application's model downloader disables TLS certificate verification when fetching models from the internet, allowing an attacker positioned on the network path to intercept and replace model files with malicious ones. This could lead to arbitrary code execution when the application loads and uses these compromised models for inference.
Technical details
The vulnerability is a disabled TLS certificate verification flaw in the download_with_retry function within anylabeling/services/auto_labeling/model.py. The code uses ssl._create_unverified_context() and passes it to urllib.request.urlopen, which bypasses validation of both the certificate chain and hostname for HTTPS model downloads. An attacker capable of intercepting network traffic can inject arbitrary model files that pass the application's format validation (safe_check_model checks file structure but not cryptographic provenance). For ONNX models, the substituted file is used directly for inference; for PyTorch .pth/.pt files (used by shipped configurations including SAM2, YOLOE, UPN, and open_vision), torch.load is called without weights_only enabled, allowing arbitrary code execution during unpickling on vulnerable PyTorch versions.
Affected products
- CVHub520 X-AnyLabeling v4.0.0-beta.8 and likely earlier versions
Timeline
- 2026-08-25: disclosed
- other: CVE-2026-79785 assigned