Microsoft winml-cli up to 0.3.x CLI API _autoconfig.py AutoConfig.from_pretrained trust_remote_code cross-domain policy

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Microsoft winml-cli up to 0.3.x. Affected is the function AutoConfig.from_pretrained of the file src/winml/modelkit/loader/_autoconfig.py of the component CLI API. This manipulation of the argument trust_remote_code causes cross-domain policy. This vulnerability is tracked as CVE-2026-84452. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in Microsoft winml-cli up to 0.3.x. Affected by this vulnerability is the function AutoConfig.from_pretrained of the file src/winml/modelkit/loader/_autoconfig.py of the component CLI API. The manipulation of the argument trust_remote_code with an unknown input leads to a cross-domain policy vulnerability. The CWE definition for the vulnerability is CWE-942. The product uses a cross-domain policy file that includes domains that should not be trusted. As an impact it is known to affect confidentiality. The summary by CVE is:

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-84452 since 09/01/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/02/2026).

Upgrading to version 0.4.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Microsoft

Name

• winml-cli

Version

• 0.1
• 0.2
• 0.3

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://github.com/microsoft/winml-cli/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion