CVE-2026-47117
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
OpenMed before 1.5.2 has a remote code execution vulnerability in the PII privacy-filter model loading path. The filter uses broad substring matching on the model_name parameter, allowing an unauthenticated attacker to load a malicious Hugging Face model with trust_remote_code=True, executing arbitrary code.
Risk Assessment
An unauthenticated attacker can execute arbitrary code on the server with OpenMed service privileges, leading to full system compromise.
Recommendation
Update OpenMed to version 1.5.2 or later. Restrict API access and strictly validate the model_name parameter.
Original NVD description (English source)
OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The privacy-filter dispatcher used broad substring matching on the user-supplied model_name parameter, allowing a value such as attacker/foo-privacy-filter-bar to route through a path that loads Hugging Face models with trust_remote_code=True. An unauthenticated attacker can supply a malicious model repository containing custom Transformers code via auto_map in config.json or tokenizer_config.json, which is imported and executed with the privileges of the OpenMed service process.