p PatchFirst

CVE-2026-6859

CVE-2026-6859 · Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.

CVSS 8.8 · High · EPSS 0.4%

Published
Updated

Stack: python

Affected products and versions

  • red hat enterprise linux ai (rhel ai) 3

    No fix published

  • red hat enterprise linux ai (rhel ai) 3

    No fix published

  • instructlab PyPI

    Versions
    • 0.14.0
    • 0.15.1
    • 0.16.0
    • 0.16.1
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.18.0
    • 0.18.0a1
    • 0.18.0a2
    • 0.18.0a3
    • 0.18.0a4
    • 0.18.0a5
    • 0.18.0a6
    • 0.18.0a7
    • 0.18.0b1
    • 0.18.0b2
    • 0.18.0b3
    • 0.18.0b4
    • 0.18.0b5
    • 0.18.0b6
    • 0.18.0rc1
    • 0.18.0rc2
    • 0.18.0rc3
    • 0.18.0rc4
    • 0.18.0rc5
    • 0.18.0rc6
    • 0.18.0rc7
    • 0.18.1
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.19.0
    • 0.19.0a1
    • 0.19.0b1
    • 0.19.0rc1
    • 0.19.1
    • 0.19.2
    • 0.19.3
    • 0.19.4
    • 0.19.5
    • 0.20.0
    • 0.20.0a1
    • 0.20.0a2
    • 0.20.1
    • 0.21.0
    • 0.21.0a0
    • 0.21.0a1
    • 0.21.1
    • 0.21.2
    • 0.22.0
    • 0.22.1
    • 0.22.2
    • 0.23.0
    • 0.23.0a0
    • 0.23.0rc0
    • 0.23.1
    • 0.23.2
    • 0.23.3
    • 0.23.4
    • 0.23.5
    • 0.24.0
    • 0.24.1
    • 0.24.2
    • 0.24.2a0
    • 0.24.3
    • 0.25
    • 0.26.0
    • 0.26.0a1
    • 0.26.1
    Affected ranges
    • ECOSYSTEM: ≤ 0.26.1

    No fix published

Original sources

Check your server →