CVE-2026-86169: Axolotl through 0.18.0 Remote Code Execution via Multipack Patching
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as basemodel, which is loaded with hardcoded trustremotecode=True during AutoModelForCausalLM.frompretrained.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Axolotlto a version that resolves this vulnerability.Fixed in 0.18.0 - Configuration
When loading a Hugging Face model, ensure trust_remote_code is set to False (avoid the default behavior that can bypass the security guard and allow arbitrary Python code execution from a malicious repository selected as base_model).
Hugging Face Transformers AutoModelForCausalLM.from_pretrained trust_remote_code = False
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Axolotl through 0.18.0 are exposed when they use the multipack patch path and load a Hugging Face model repository as the base_model. The vulnerable load operation enables remote code execution from the selected repository.
What does an attacker need to exploit it?
An attacker needs to cause a malicious Hugging Face model repository to be selected as base_model. Exploitation also requires a user to initiate the model-loading workflow, as reflected by the user-interaction requirement.
Are default trust settings sufficient protection?
No. In the affected multipack patch path, trust_remote_code defaults to None rather than False, and the model is loaded with trust_remote_code hardcoded to True, bypassing the intended security guard.
What can be done before a fix is applied?
Avoid the affected multipack patch workflow for untrusted or unverified base_model repositories. Restrict base_model selection to repositories you control or have independently reviewed for executable Python code.