Is CVE-2026-86169 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86169?

CVE-2026-86169 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-86169

Description

Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.