Remote Code Execution Vulnerability in Axolotl Affects Multiple Users

A remote code execution vulnerability identified as CVE-2026-86169 affects Axolotl versions up to 0.18.0. The flaw arises from the multipack patch path where the trust_remote_code setting defaults to None instead of False, allowing attackers to bypass security measures. By crafting a malicious Hugging Face model repository, attackers can execute arbitrary Python code during the loading process. This vulnerability has a CVSS score of 8.7, indicating a high severity level. Users of Axolotl are urged to apply patches immediately to mitigate risks. The vulnerability was published on September 5, 2026, and is currently not known to be actively exploited. The issue has been addressed in a patch available on GitHub.

Key Points: • CVE-2026-86169 allows remote code execution in Axolotl versions up to 0.18.0. • Attackers can exploit the flaw by using malicious Hugging Face model repositories. • A patch is available, and users should update their systems immediately.