Remote Code Execution Vulnerability in Axolotl by Axolotl AI Cloud

CVE-2026-86169

What is CVE-2026-86169?

Axolotl through version 0.18.0 is susceptible to a remote code execution vulnerability due to inadequate validation in the multipack patch path. The configuration setting trust_remote_code defaults to None, which can permit attackers to bypass security measures. By exploiting a crafted malicious model repository from Hugging Face, an attacker is able to execute arbitrary Python code during the process of loading models with hardcoded trust_remote_code set to True. This poses significant risks, highlighting the importance of ensuring robust security configurations.

References