Database/AI/ML frameworks & serving
finetrainers: code injection through the library field of a model index
Impact
finetrainers 0.1.0 and 0.2.0 resolve model component classes in resolve_component_cls (finetrainers/utils/model.py) from the library argument of the model index without enough validation, and a crafted value leads to code injection. Anyone who can get a training job to load a model index they wrote could run code with the training job's privileges on the GPU node. A public proof of concept exists. The record does not say exactly what triggers it, and the CNA scored it low (CVSS 4.0 2.1, user interaction required).
Who can reach it
Remote, no authentication. The attacker supplies a model or model index that an operator or user then loads with finetrainers (user interaction required).
What to do
The record lists no fix, and the project had not answered the issue report when this was published. Load only models and model index files from trusted sources, run finetrainers jobs in unprivileged and isolated containers, and watch issue #435 for a patched release.
References
Related entries
- mistral.rs: out-of-bounds read parsing GGUF token id metadata crashes the inference serverCVE-2026-75090 · mistral.rs GGUF tokenizer (convert_gguf_to_hf_tokenizer)Low
- Ollama: integer overflow in the GGUF v1 string reader when parsing a crafted model fileCVE-2026-86289 · Ollama GGUF decoder (readGGUFV1String in fs/ggml/gguf.go)Low
- vLLM: attacker-supplied chat_template burns server resources on the GPU nodeCVE-2026-90878 · vLLM OpenAI-compatible server (/v1/chat/completions Jinja chat_template rendering)Low
- PowerInfer: unvalidated data_offset in the GGUF parser causes an out-of-bounds read when loading a modelCVE-2026-108955 · PowerInfer GGUF parser (gguf_init_from_file, data_offset)Low
- PowerInfer: out-of-bounds read in the CUDA FFN GPU-split loader while staging weights to the deviceCVE-2026-108960 · PowerInfer CUDA FFN GPU-split loader (create_striped_mat_to_gpu)Low
- vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU nodeCVE-2026-90713 · vLLM (Rust tiktoken vocab file handler, TiktokenTokenizer::new)Low
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.