ACVE-2026-0314

In the wild

demonstrated · research

Description

What

The InstructLab advisory describes ilab train, download, and generate paths that hard-code trust_remote_code when loading a Hugging Face model. That setting turns repository Python into executable serving or training input. The research gives the CVE and advisory but does not establish a fixed package version in the lock, so the package range remains open pending grounding.

Which configuration is exposed

The exposed setup is an InstructLab command operating on a model whose namespace metadata is unknown or newer than the 2026-04-22 disclosure. The model may be legitimate, but remote code trust makes its repository contents part of the execution boundary. The lock cannot see the ilab subcommand, so the model-side namespace signal is conservative.

How ACVE detects it

ACVE checks the captured namespaceCreatedAt for any reachable model. A missing value produces possible rather than clean; a date on or after the first-seen date confirms the review condition in a fixture. The PyPI affected entry preserves the real ecosystem and CVE alias while the matcher records the observable model condition.

Fix

Upgrade InstructLab to the vendor-fixed release after confirming its version, disable remote-code loading where the command permits it, and pin the model revision and file hashes. Review model repository Python before training or generation and isolate the job from credentials and production network access.

Grounding needed

The GitHub advisory and Red Hat release guidance must establish the exact fixed InstructLab version. Until that check is available, the fix uses a placeholder target and the record remains a candidate with a version-enrichment limitation.

Configuration

some models where
  namespaceCreatedAt gte "2026-04-22T00:00:00Z"

Fix

Upgrade InstructLab after the vendor fix and review remote model code.

• Upgrade pypi:instructlab. Use the vendor-fixed release once confirmed.
• Reconfigure model.revision. Pin a reviewed model revision.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

ADVISORY

• https://github.com/advisories/GHSA-rxpq-xgqx-fr7p