Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub. This vulnerability can lead to complete system compromise.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
A new vulnerability with increased severity was disclosed for Red Hat Enterprise Linux AI (CVE-2026-6859) https://vuldb.com/vuln/358847
Post summary
A new vulnerability (CVE-2026-6859) affecting Red Hat Enterprise Linux AI has been disclosed with an increased severity rating, but no detailed technical data, PoC, or mitigation steps are provided.
CVE-2026-6859 A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to a… https://www.cve.org/CVERecord?id=CVE-2026-6859
Post summary
The CVE identifies that InstructLab’s training script hardcodes a parameter allowing remote code execution, with technical detail but no PoC, exploit, or patch mentioned.
CVE-2026-6859 Remote Code Execution in InstructLab via Hardcoded Trust Remote Code Setting https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6859
Post summary
A new CVE-2026-6859 vulnerability has been disclosed, revealing a remote code execution flaw in InstructLab caused by a hardcoded trust remote code setting.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | redhat | enterprise_linux_ai | 3.0 | - | - |
| App | redhat | instructlab | - | - | - |