Improper Certificate Validation in X-AnyLabeling Model Downloads

CVE-2026-79785

What is CVE-2026-79785?

The X-AnyLabeling model downloader has a critical flaw due to the disabling of TLS certificate verification. This vulnerability allows an attacker to intercept downloads and serve malicious content without detection. The model downloader's method, download_with_retry, creates an unverified SSL context and utilizes this context when fetching models over HTTPS. Consequently, connections are susceptible to man-in-the-middle attacks, enabling the attacker to substitute legitimate model files with harmful versions. The lack of provenance checks after download further exacerbates the risk, as the application could execute compromised code when using these models, particularly for ONNX and PyTorch targets. This flaw highlights the urgent need for SSL verification and robust file validation mechanisms.

References