Skip to content
Threat Feed

Tag

Instructlab

2 briefs RSS
critical advisory

InstructLab Arbitrary Code Execution via Malicious HuggingFace Model

InstructLab is vulnerable to arbitrary code execution because the `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace, allowing remote attackers to execute code by convincing a user to load a malicious model.

InstructLab cve code-execution huggingface
2r 1t 1c
high advisory

InstructLab Path Traversal Vulnerability (CVE-2026-6855)

A local attacker can exploit a path traversal vulnerability in InstructLab by manipulating the `logs_dir` parameter, leading to arbitrary file creation and modification.

path-traversal instructlab cve-2026-6855
2r 1t 1c