Remote Code Execution in InternScience InternAgent

Executive Summary

CVE-2026-115802 is a model-provenance poisoning vulnerability in InternScience InternAgent 1.5.0. It occurs in the LoRA Loading component where the base_model_name_or_path argument in experiment.py is not validated. An attacker can craft a malicious LoRA adapter that redirects the training pipeline to fetch a poisoned base model from a remote repository without proper checks. This allows silent override of the operator's intended base model, compromising the integrity of the fine-tuning process.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected network connections to remote Hugging Face Hub repositories during model training. Inspect adapter_config.json files in LoRA adapters for untrusted base_model_name_or_path values. Look for mismatches between operator-provided --pretrained_model_path and adapter-declared base_model_name_or_path.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to compromise the integrity of trained machine learning models. If you use InternAgent for fine-tuning models, an attacker could provide a malicious LoRA adapter that forces your system to use a poisoned base model from an untrusted source. This could lead to incorrect or manipulated model outputs, affecting downstream tasks like scientific discovery or automated research.

Useful 0 Not Useful 0

Mitigation Strategies

Validate base_model_name_or_path against an allowlist. Prioritize operator-provided --pretrained_model_path over adapter-declared values. Fail loudly or warn on mismatches. Restrict model loading to trusted sources only.

Useful 0 Not Useful 0