Executive brief
Axolotl is an open-source framework for fine-tuning language models. Versions before 0.19.0 contain a remote code execution vulnerability where a security check is bypassed, allowing attackers to execute arbitrary Python code by crafting a malicious model repository. An attacker can compromise any system using Axolotl to train or load models, leading to complete system takeover and data theft.
Technical details
The vulnerability exists in the multipack patch path where the trust_remote_code parameter defaults to None instead of False, bypassing a security guard that should prevent automatic code execution. During model loading via AutoModelForCausalLM.from_pretrained, the code is hardcoded to use trust_remote_code=True, which trusts and executes arbitrary Python code from a malicious Hugging Face model repository specified as base_model. The attack requires an attacker to control or compromise a Hugging Face model repository that a victim selects for training, and the victim must run Axolotl without explicit trust_remote_code configuration. A patch is available in Axolotl version 0.19.0 and later.
Affected products
- Axolotl Axolotl before 0.19.0
Timeline
- 2026-09-05: disclosed