# CVE-2026-124588: huggingface finetrainers Model Index model.py resolve_component_cls code injection

> CVE-2026-124588: huggingface finetrainers Model Index model.py resolve_component_cls code injection. CVSS 6.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-124588
Last updated: 2026-11-09T10:17:09Z

- Published: 2026-11-09 09:45 UTC · Updated: 2026-11-09 10:17 UTC · Assigner: VulDB
- CVSS: 6.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
- EPSS: 0.32%, 25th percentile (scored 2026-11-10)
- CISA KEV: no
- CWE: CWE-74, CWE-94

## Description

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolve\_component\_cls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

## Affected vendors and products

- huggingface: finetrainers

## Tracked companies

- [Hugging Face](https://rewindex.com/company/hugging-face.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-124588)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-124588)
- [https://github.com/huggingface/finetrainers/](https://github.com/huggingface/finetrainers/)
- [https://github.com/huggingface/finetrainers/issues/435](https://github.com/huggingface/finetrainers/issues/435)
- [https://github.com/user-attachments/files/33587108/poc.zip](https://github.com/user-attachments/files/33587108/poc.zip)
- [https://vuldb.com/cve/CVE-2026-124588](https://vuldb.com/cve/CVE-2026-124588)
- [https://vuldb.com/submit/1040375](https://vuldb.com/submit/1040375)
- [https://vuldb.com/vuln/433012](https://vuldb.com/vuln/433012)
- [https://vuldb.com/vuln/433012/cti](https://vuldb.com/vuln/433012/cti)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-124588 · Markdown: https://rewindex.com/cve/CVE-2026-124588.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-124588 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T05:26:47.224Z