{"id":"CVE-2026-84452","title":"Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML","summary":"Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API…","severity":"high","cwe":["CWE-306","CWE-942"],"vendor":"winml-cli","product":"winml-cli","affected":["winml-cli < 0.4.0"],"patched":["winml-cli 0.4.0"],"published":"2026-09-02","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84452","references":[{"url":"https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993","label":"security-advisories@github.com"},{"url":"https://github.com/microsoft/winml-cli/pull/1321","label":"security-advisories@github.com"},{"url":"https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf","label":"security-advisories@github.com"},{"url":"https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84452"},{"url":"https://github.com/microsoft/winml-cli"},{"url":"https://github.com/advisories/GHSA-96p9-rh4f-92cf"},{"url":"https://pypi.org/project/winml-cli"}],"tags":["nvd","osv","pip","ghsa"],"epss":0.00945,"epssPercentile":0.59016,"aliases":["GHSA-96p9-rh4f-92cf","PYSEC-2026-3944"],"ecosystem":"pip","ingestedAt":"2026-09-08T22:12:30.968Z","slug":"CVE-2026-84452","body":"## Overview\n\nWindows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-84452)\n\nAffected packages:\n\n- `winml-cli < 0.4.0`\n\nPatched in:\n\n- `winml-cli 0.4.0`\n\nSource: https://osv.dev/vulnerability/GHSA-96p9-rh4f-92cf","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}