---
id: CVE-2026-84452
title: >-
  Windows ML CLI is a command line tool for building portable, performant, and
  high-quality AI models for Windows ML
summary: >-
  Windows ML CLI is a command line tool for building portable, performant, and
  high-quality AI models for Windows ML. Prior to 0.4.0, the
  src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands
  through a localhost HTTP API…
severity: high
cwe:
  - CWE-306
  - CWE-942
vendor: winml-cli
product: winml-cli
affected:
  - winml-cli < 0.4.0
patched:
  - winml-cli 0.4.0
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84452'
references:
  - url: >-
      https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993
    label: security-advisories@github.com
  - url: 'https://github.com/microsoft/winml-cli/pull/1321'
    label: security-advisories@github.com
  - url: >-
      https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf
    label: security-advisories@github.com
  - url: >-
      https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84452'
  - url: 'https://github.com/microsoft/winml-cli'
  - url: 'https://github.com/advisories/GHSA-96p9-rh4f-92cf'
  - url: 'https://pypi.org/project/winml-cli'
tags:
  - nvd
  - osv
  - pip
  - ghsa
epss: 0.01608
epssPercentile: 0.74846
aliases:
  - GHSA-96p9-rh4f-92cf
  - PYSEC-2026-3944
ecosystem: pip
ingestedAt: '2026-09-08T22:12:30.968Z'
---

## Overview

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84452)

Affected packages:

- `winml-cli < 0.4.0`

Patched in:

- `winml-cli 0.4.0`

Source: https://osv.dev/vulnerability/GHSA-96p9-rh4f-92cf