---
id: CVE-2026-115802
title: >-
  InternScience InternAgent LoRA Loading experiment.py train inclusion of
  functionality from untrusted control sphere
summary: >-
  A weakness has been identified in InternScience InternAgent 1.5.0. This
  affects the function train of the file tasks/AutoChem/code/experiment.py of
  the component LoRA Loading. This manipulation of the argument
  base_model_name_or_path cau…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-829
vendor: InternScience
product: InternAgent
affected:
  - InternAgent 1.5.0
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T06:30:15.142Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115802'
references:
  - url: 'https://vuldb.com/vuln/425984'
    label: >-
      VDB-425984 | InternScience InternAgent LoRA Loading experiment.py train
      inclusion of functionality from untrusted control sphere
  - url: 'https://vuldb.com/vuln/425984/cti'
    label: 'VDB-425984 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-115802'
    label: CVE-2026-115802 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1022289'
    label: >-
      Submit #1022289 | InternScience InternAgent commit
      fa8c3eedfa9751d3752ea6eb49220b303ac2397d (main HEAD as of 2026-07-29)
      Improper Input Validation
  - url: 'https://github.com/InternScience/InternAgent/issues/30'
  - url: 'https://github.com/user-attachments/files/33260564/poc.zip'
  - url: 'https://github.com/InternScience/InternAgent/'
tags:
  - cve.org
ingestedAt: '2026-10-24T06:53:46.599Z'
---

## Overview

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

## Affected

- `InternAgent 1.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.