{"data":{"id":"df5fa3eb-7b24-4267-aefd-3cfcc6307fd6","title":"CVE-2026-31228: The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow…","summary":"CVE-2026-31228 affects the Adversarial Robustness Toolbox (ART) through 1.20.1, in its Kubeflow component. The robustness evaluation function for PyTorch models passes user-supplied strings for the LossFn and Optimizer parameters to eval() without sanitization, so an attacker can supply a crafted string containing arbitrary Python code. That code runs when eval() is called, giving the attacker full control of the system running the ART evaluation.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31228","publishedAt":"2026-05-12T16:16:14.633Z","cveId":"CVE-2026-31228","cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Adversarial Robustness Toolbox (ART)","Kubeflow","PyTorch"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Adversarial Robustness Toolbox remote code execution in Kubeflow via eval()","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01066,"epssCheckedAt":"2026-10-14T18:05:58.877Z","kevDateAdded":null,"advisoryAliases":["GHSA-8r6g-7rr9-mx32"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:48:32.516Z","patchAvailable":null,"disclosureDate":"2026-05-12T16:16:14.633Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}