InstructLab: model loading hardcodes trust_remote_code=True, executing code from HuggingFace models

Impact

linux_train.py loads HuggingFace models with trust_remote_code=True unconditionally, so any model repository's custom Python runs as the user invoking ilab train, download, or generate. On a shared fine-tuning node that is arbitrary code execution with access to the GPUs, the local dataset, mounted storage, and any cloud credentials in the environment. Red Hat ships this in RHEL AI 3, where the training user frequently has broad access to the accelerator fleet. Exploitation needs a user to be persuaded to use a specific model, which is routine in practice.

Who can reach it

Remote attacker publishes a malicious model on the HuggingFace Hub; a local user with GPU access runs ilab train/download/generate against it. No authentication to the attacker-controlled side; user interaction required.

What to do

Apply the Red Hat update for RHEL AI 3 when available and restart any training workflows; the Red Hat CVE page and VEX document track fixed package state. Until patched, restrict which model repositories the fine-tuning nodes can pull from and treat any model directory as executable code.

References

Related entries

• Hugging Face peft: CorDA and LoRA-GA load cache files with unsafe torch.load, giving code executionCVE-2026-71281 · Hugging Face peft - LoRA-GA and CorDA initialization (torch.load without weights_only)High
• ChromaDB (Rust): Missing authorization validationCVE-2026-8828 · ChromaDB (Rust)High
• LangBot: debug WebSocket on 0.0.0.0:5401 accepts plugin registration with no key setCVE-2026-90938 · LangBot plugin runtime (langbot_plugin debug WebSocket on 0.0.0.0:5401)High
• SGLang: unauthenticated PUT /route poisons the KV transfer routing table in disaggregated modeCVE-2026-92972 · SGLang prefill bootstrap service (unauthenticated PUT /route)High
• vLLM OpenAI-compatible server (qwen3_coder tool-call parser): Code execution inside the serving process, which on a GPUNCVD-2025-017-vllm-openai-compatible-server-qw · vLLM OpenAI-compatible server (qwen3_coder tool-call parser)High
• vLLM (multimodal prompt embeddings, sparse tensor validation): This is the advisory saying the earlier fix did notNCVD-2026-043-vllm-multimodal-prompt-embedding · vLLM (multimodal prompt embeddings, sparse tensor validation)High