Executive brief
Windows ML CLI is a command-line tool for building and configuring machine learning models. An attacker can trick a user into visiting a malicious website, which then sends HTTP requests to the locally-running ML CLI server. Due to overly permissive CORS (Cross-Origin Resource Sharing) settings and insufficient validation of the "trust_remote_code" parameter, the attacker can execute arbitrary code on the victim's machine with the privileges of the user running the ML CLI service. This could lead to complete compromise of the user's system, data theft, or installation of malware.
Technical details
The vulnerability is a combination of two security flaws in the winml-cli project. First, the serve/cli_api.py component exposes all CLI commands over an HTTP API without authentication, binding to localhost by default. However, it sets allow_origins to ["*"], permitting any website to make cross-origin requests to the endpoint and read responses, bypassing the loopback isolation boundary. Second, the 'build' and 'config' commands accept a --trust-remote-code parameter that is passed directly and unvalidated to transformers' AutoConfig.from_pretrained() function. When this flag is true, transformers automatically executes Python code from the model repository during import, allowing Remote Code Execution. An attacker hosting a malicious model repository can trigger this by convincing a user to visit a webpage that sends a crafted HTTP POST request to the local API. The payload executes with the privileges of the winml-cli process. This was patched in version 0.4.0.
Affected products
- Microsoft winml-cli < 0.4.0
Timeline
- 2026-08-28: disclosed
- 2026-09-08: advisory
- 2026-09-08: patched: version 0.4.0 released