{"id":"CVE-2026-115802","title":"InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere","summary":"A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path cau…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-829"],"vendor":"InternScience","product":"InternAgent","affected":["InternAgent 1.5.0"],"published":"2026-10-24","updated":"2026-10-24","sourceUpdated":"2026-10-24T06:30:15.142Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115802","references":[{"url":"https://vuldb.com/vuln/425984","label":"VDB-425984 | InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere"},{"url":"https://vuldb.com/vuln/425984/cti","label":"VDB-425984 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-115802","label":"CVE-2026-115802 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1022289","label":"Submit #1022289 | InternScience InternAgent commit fa8c3eedfa9751d3752ea6eb49220b303ac2397d (main HEAD as of 2026-07-29) Improper Input Validation"},{"url":"https://github.com/InternScience/InternAgent/issues/30"},{"url":"https://github.com/user-attachments/files/33260564/poc.zip"},{"url":"https://github.com/InternScience/InternAgent/"}],"tags":["cve.org"],"ingestedAt":"2026-10-24T06:53:46.599Z","slug":"CVE-2026-115802","body":"## Overview\n\nA weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.\n\n## Affected\n\n- `InternAgent 1.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}