Description

Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-05T11:16:45.703Z",
  "pubdate": "2026-09-05T11:16:45.703Z",
  "executiveSummary": "Axolotl versions up to 0.18.0 are susceptible to a Remote Code Execution (RCE) vulnerability stemming from improper input validation and insecure configuration of the Hugging Face Transformers library.\nThe vulnerability occurs within the multipack patch mechanism, where the 'trust_remote_code' parameter defaults to 'None' rather than the secure default of 'False'.\nThis failure allows the security guard mechanism to be bypassed when loading models.\nAn attacker can exploit this by hosting a malicious Hugging Face model repository and configuring it as the 'base_model' for an Axolotl task.\nUpon initialization, the system inadvertently executes arbitrary Python code contained within the model repository's 'modeling_*.py' files during the execution of 'AutoModelForCausalLM.from_pretrained'.\nThis vulnerability poses a critical risk to systems using Axolotl for training or fine-tuning, as successful exploitation results in full code execution on the host machine, potentially leading to unauthorized data access, system compromise, or exfiltration of sensitive training environments.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of the 'trust_remote_code' parameter within the Axolotl multipack patch logic. In the Hugging Face 'transformers' library, the 'from_pretrained' method accepts a 'trust_remote_code' argument to determine whether to execute custom model code defined in a Hugging Face repository. If set to 'True', arbitrary Python code residing in the repository is executed automatically upon loading.\nIn Axolotl versions 0.18.0 and earlier, the multipack implementation fails to explicitly set this parameter to 'False' as a security baseline. Because the parameter defaults to 'None' (which is interpreted as 'False' by default in some contexts but treated inconsistently in this specific implementation path), the safety guard meant to prevent the execution of untrusted remote code is effectively nullified.\nThe attack flow proceeds as follows: First, an attacker creates a malicious model repository on the Hugging Face Hub, incorporating arbitrary Python instructions into the custom model architecture files (e.g., 'modeling_*.py'). Second, the attacker entices a victim to utilize this malicious repository as the 'base_model' within an Axolotl configuration file. Third, when the victim initiates the training or fine-tuning process using Axolotl, the system invokes 'AutoModelForCausalLM.from_pretrained'.\nDuring this call, the underlying logic forces 'trust_remote_code=True' because the initial security guard intended to prevent this action is bypassed. Consequently, the Hugging Face library executes the malicious Python code embedded in the repository with the same privileges as the user running the Axolotl process. This occurs automatically during the model loading phase, requiring no further interaction from the user after the process is started. Post-exploitation impact is severe, granting the attacker the ability to execute shell commands, install persistent backdoors, or access environment variables containing secrets like Hugging Face tokens, API keys, or infrastructure credentials."
}