CVE-2026-84452

Received Received - Intake

Remote Code Execution in Windows ML CLI

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-02

Last Modified

2026-09-02

Generated

2026-09-03

AI Q&A

2026-09-03

EPSS Evaluated

N/A

NVD

CVE-2026-84452

EUVD

EUVD-2026-70264

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	winml-cli	to 0.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

This vulnerability is a Remote Code Execution (RCE) flaw in the Windows ML CLI tool before version 0.4.0. It occurs because the tool exposes CLI commands via a localhost HTTP API without authentication and uses wildcard CORS settings. A malicious website can send cross-origin requests to specific endpoints and set a parameter that enables arbitrary code execution on the server.

Detection Guidance

Check if WinML CLI version is below 0.4.0 by running 'winml --version'. If the version is older, the system is vulnerable. Inspect network traffic for localhost HTTP requests to /v1/cli/build or /v1/cli/config with trust_remote_code=true. Monitor for unexpected Python code execution or model loading from untrusted sources.

Impact Analysis

If you run the vulnerable WinML CLI version, an attacker could trick you into visiting a malicious website. This site could then execute arbitrary code on your system with your permissions. The attack requires no authentication and exploits improper CORS and parameter validation in the tool.

Compliance Impact

This RCE vulnerability could lead to unauthorized code execution on systems handling sensitive data, violating GDPR's integrity principle or HIPAA's security requirements for protected health information. Compliance may be compromised if attackers gain access to regulated data.

Mitigation Strategies

Upgrade WinML CLI to version 0.4.0 or later immediately. Disable the WinML CLI HTTP API if not required. Restrict network access to localhost services. Review and remove any untrusted model repositories or configurations. Monitor for suspicious activity related to Python code execution or remote model loading.

Hi! I’m here to help you understand CVE-2026-84452. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70