HighVulnerability
GHSA-96p9-rh4f-92cf: Windows ML CLI: CORS misconfig enables localhost RCE
- Identifiers
- CVE-2026-84452GHSA-96p9-rh4f-92cf
- Published
- Record updated
- Affected
- winml-cli < 0.4.0
- Fixed in
- 0.4.0
- released October 20, 2026, 43 days after disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.6%
Summary
The winml-cli project's serve/cli_api.py exposes all winml CLI commands over HTTP without authentication and sets allow_origins to a wildcard, so any website can call the localhost endpoint. Combined with the --trust-remote-code flag in the build and config commands, an attacker hosting a malicious model repository can run arbitrary code as the server user. The report's proof of concept demonstrates execution from a cross-origin request.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- HighCVE-2026-108456 Azure AI Foundry Elevation of Privilege VulnerabilitySame vendor · MSRC Security Update Guide
- HighGHSA-h4xc-3qfq-jf93: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointSame vendor · GitHub Advisory Database
- LowGHSA-6gw6-rv2g-25mg: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsSame vendor · GitHub Advisory Database
- MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
- HighCVE-2026-85887: M365 Copilot incorrect permission assignment allows information disclosureSame vendor · NVD/CVE Database