CVE-2026-84452: Windows ML CLI: CORS misconfig enables localhost RCE
Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setting as a wildcard in both src/winml/modelkit/serve/cliapi.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trustremotecode parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.frompretrained with trustremotecode=True in src/winml/modelkit/loader/autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Windows ML CLIto a version that resolves this vulnerability.Fixed in 0.4.0 - Configuration
Update src/winml/modelkit/serve/cli_api.py to no longer configure allow_origins as a wildcard; restrict CORS origins to trusted values so cross-origin requests cannot set config such as trust_remote_code via the localhost HTTP API.
src/winml/modelkit/serve/cli_api.py allow_origins = wildcard - Configuration
Update src/winml/modelkit/serve/app.py to no longer configure allow_origins as a wildcard; restrict CORS origins to trusted values so cross-origin requests cannot set config such as trust_remote_code via the localhost HTTP API.
src/winml/modelkit/serve/app.py allow_origins = wildcard
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to persuade a user to load a malicious website while the Windows ML CLI localhost HTTP API is available. The attack is performed from the user's browser against the local service and does not require authentication to that API.
What configurations are affected?
Versions prior to 0.4.0 are affected because the localhost API has no authentication and allows cross-origin requests from any origin. The vulnerable endpoints are /v1/cli/build and /v1/cli/config when an attacker can set trust_remote_code to true.
What is the impact of successful exploitation?
The attacker can cause Python code from an attacker-controlled model repository to be imported. That code executes with the privileges of the user running the Windows ML CLI server.
What should teams do to remediate this issue?
Upgrade Windows ML CLI to version 0.4.0. The provided information does not identify a separate temporary mitigation for systems that cannot yet be upgraded.