Dashboard / CVE-2026-124588

CVE-2026-124588

LOW
INFO Priority: 0.01 BB Relevance: 54/100
Published: 2026-11-09 Modified: 2026-11-13 First seen: 2026-11-09 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve_component_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Weakness Classification (2)

Affected Software (4)

VendorProductVersion
huggingface finetrainers 0.1.0
huggingface finetrainers 0.2.0
huggingface finetrainers 0.1.0
huggingface finetrainers 0.2.0

References & Advisories (7)

https://vuldb.com/vuln/433012
vdb-entry technical-description
https://vuldb.com/submit/1040375
third-party-advisory
https://vuldb.com/vuln/433012/cti
signature permissions-required

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

2.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.32%
Raw Score 0.003150
Percentile 24.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00315
2026-11-12
0.00315
2026-11-10
0.00315

Intelligence Sources

mitre ref →
nvd ref →

External Links