{"data":{"id":"6ecf0de3-dcc6-4df6-ac1c-4af75a8c2b39","title":"CVE-2026-122160: A security vulnerability has been detected in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function…","summary":"A vulnerability in myshell-ai AIlice up to 0.4.0 affects the function LoadModel_PEFT in ailice/core/llm/AModelCausalLM.py, within the HuggingFace Model Wrapper component. Manipulating the argument base_model_name_or_path leads to inclusion of functionality from an untrusted control sphere, and the attack can be launched remotely. The exploit is public, and the project was informed through an issue report but has not responded.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-122160","publishedAt":"2026-11-05T03:17:21.133Z","cveId":"CVE-2026-122160","cweIds":["CWE-829"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["AIlice"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"myshell-ai AIlice HuggingFace Model Wrapper untrusted model loading","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-05T06:10:13.208Z","kevDateAdded":null,"advisoryAliases":["GHSA-6wf7-9xfh-x657"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-05T06:10:16.902Z","patchAvailable":null,"disclosureDate":"2026-11-05T03:17:21.133Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-437"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}