Remote Code Execution Vulnerability in Axolotl Affects Multiple Users
Article Content
- •CVE-2026-86169 allows remote code execution in Axolotl versions up to 0.18.0.
- •Attackers can exploit the flaw by using malicious Hugging Face model repositories.
- •A patch is available, and users should update their systems immediately.
A remote code execution vulnerability identified as CVE-2026-86169 affects Axolotl versions up to 0.18.0. The flaw arises from the multipack patch path where the trust_remote_code setting defaults to None instead of False, allowing attackers to bypass security measures. By crafting a malicious Hugging Face model repository, attackers can execute arbitrary Python code during the loading process. This vulnerability has a CVSS score of 8.7, indicating a high severity level. Users of Axolotl are urged to apply patches immediately to mitigate risks. The vulnerability was published on September 5, 2026, and is currently not known to be actively exploited. The issue has been addressed in a patch available on GitHub.
Ask AI about this cluster
Answers cite the sources they use
More articles in this cluster (2)
Following this threat?
Track CVE-2026-86169 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…