{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftwinml-cli/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:winml-cli:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-84452"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["winml-cli (\u003c 0.4.0)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","web-application","cors"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe 'winml-cli' project contains a critical security vulnerability (CVE-2026-84452) in its 'serve/cli_api.py' component that facilitates Remote Code Execution (RCE). The tool launches a local HTTP API server that binds to 127.0.0.1 by default; however, it incorrectly configures Cross-Origin Resource Sharing (CORS) by setting 'allow_origins' to a wildcard ('*'). This configuration allows any website visited by the user to send requests to the local winml-cli instance, effectively bypassing the intended localhost-only network boundary.\u003c/p\u003e\n\u003cp\u003eFurthermore, the API exposes 'build' and 'config' commands that accept the '--trust-remote-code' parameter. By injecting this parameter through a crafted cross-origin request, an attacker can force the application to load a malicious model repository. The underlying 'transformers' library then imports Python code from the repository, leading to immediate code execution under the context of the user running the CLI server. This vulnerability affects versions of 'winml-cli' prior to 0.4.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim starts the winml-cli HTTP API server locally using 'python -m uvicorn winml.modelkit.serve.cli_api:app'.\u003c/li\u003e\n\u003cli\u003eAn attacker hosts a malicious model repository containing a 'configuration_pwn.py' file with embedded Python code.\u003c/li\u003e\n\u003cli\u003eThe victim is lured to an attacker-controlled website that contains malicious JavaScript.\u003c/li\u003e\n\u003cli\u003eThe JavaScript sends a cross-origin POST request to 'http://127.0.0.1:8000/v1/cli/build' due to the overly permissive CORS wildcard.\u003c/li\u003e\n\u003cli\u003eThe request includes JSON data setting 'trust_remote_code' to 'true' and pointing the 'model' argument to the attacker-controlled model repository.\u003c/li\u003e\n\u003cli\u003eThe 'winml-cli' server processes the request and executes 'AutoConfig.from_pretrained' with the 'trust_remote_code=True' flag.\u003c/li\u003e\n\u003cli\u003eThe 'transformers' library imports the malicious module from the remote repository, triggering the embedded arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full Remote Code Execution (RCE) on the victim's machine under the privileges of the user running the winml-cli process. This can lead to local data exfiltration, installation of persistent backdoors, or lateral movement within the user's environment. This vulnerability primarily impacts developers and data scientists using winml-cli in local development workflows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade 'winml-cli' to version 0.4.0 or later immediately to resolve the CORS misconfiguration and the unsafe handling of 'trust_remote_code'.\u003c/li\u003e\n\u003cli\u003eImplement local firewall rules to restrict traffic to the port used by the winml-cli API (default 8000) to explicitly trusted processes if feasible.\u003c/li\u003e\n\u003cli\u003eAvoid running the winml-cli server while browsing untrusted websites.\u003c/li\u003e\n\u003cli\u003eDeploy network-level protections to alert on unexpected POST requests to 'http://127.0.0.1:8000' originating from web browser processes.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-08T21:49:54Z","date_published":"2026-09-08T21:49:54Z","id":"https://feed.craftedsignal.io/briefs/2026-09-winml-rce/","summary":"An unauthenticated RCE vulnerability in winml-cli (CVE-2026-84452) allows remote attackers to execute arbitrary code via a malicious website sending cross-origin requests to the local API server.","title":"Remote Code Execution via CORS Misconfiguration in winml-cli","url":"https://feed.craftedsignal.io/briefs/2026-09-winml-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:winml-Cli:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}