CVE-2026-86169

Axolotl through 0.18.0 contains a remote code execution flaw in its multipack patch path, where trust_remote_code defaults to None instead of False, allowing a security guard designed to block remote code loading to be bypassed. When a user selects an attacker-crafted Hugging Face repository as the base_model, it is loaded via AutoModelForCausalLM.from_pretrained with hardcoded trust_remote_code=True, executing attacker-supplied Python code from the repository. An attacker gains arbitrary code execution on the machine running the fine-tuning job, with that process's privileges and potential access to training data, model weights, and credentials in the environment. Anyone running an affected Axolotl version who fine-tunes from a Hugging Face base model is affected, and triggering the flaw requires user interaction in the form of choosing the malicious repository. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Upgrade Axolotl to a release newer than 0.18.0 as soon as a patched version is published, checking the project's GitHub releases and security advisories for the fixed version. Until then, use only base_model repositories you control or have vetted, and keep trust_remote_code disabled wherever it is configurable. Audit recent fine-tuning runs that pulled base models from Hugging Face for untrusted repositories and treat hosts that ran such jobs as potentially compromised.