CVE-2026-84452

Microsoft's winml-cli HTTP API component (serve/cli_api.py) exposes every CLI command over unauthenticated HTTP; although the server binds to 127.0.0.1 by default, it sets a wildcard allow_origins value, so any website the victim visits can silently issue cross-origin requests to the local endpoint from the browser. The build and config commands forward an unfiltered trust_remote_code value from the request JSON, causing AutoConfig.from_pretrained() to import and execute Python shipped in an attacker-chosen model repository, with the payload running at import time. An attacker who hosts a malicious model repository and lures the user of a running winml-cli server to an attacker-controlled page gains arbitrary code execution on that machine as the user running the server. Affected users are developers running the pip-distributed winml-cli HTTP API with default CORS settings; no specific affected or patched version ranges have been published in the available data. Exploitation has not been observed publicly: no public PoC is known, the CVE is not in CISA KEV, and EPSS assigns a low ~0.9% probability of exploitation within 30 days (59th percentile).

What to do: Until Microsoft publishes a patched release (watch the MSRC advisory for CVE-2026-84452), avoid running the winml-cli HTTP API server while browsing untrusted sites, or restrict the wildcard allow_origins in serve/cli_api.py (duplicated in app.py) to trusted origins while keeping the loopback bind. Do not pass trust_remote_code=true to build/config for model repositories you do not control, since the unfiltered trust_remote_code flag is the RCE trigger; treat any externally referenced model repository as untrusted. Confirm whether your deployment runs the cli_api FastAPI/uvicorn service, as only those hosts are exposed to this attack.