CVE-2026-31228

Description

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval() function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without any sanitization or security restrictions. An attacker can exploit this by providing a specially crafted string that contains arbitrary Python code, which will be executed when eval() is called, leading to complete compromise of the system running the ART evaluation.

Traduire en français

Produits concernés

• Red Hat OpenShift AI (RHOAI)

Scores CVSS

Faiblesses (CWE)

• CWE-94

Références

• https://github.com/Trusted-AI/adversarial-robustness-toolbox
• https://www.notion.so/CVE-2026-31228-35d1e1393188817f9ab0dc4b1651dfe9
• https://access.redhat.com/security/cve/CVE-2026-31228
• https://bugzilla.redhat.com/show_bug.cgi?id=2476522
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31228.json

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories