Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-84452: WinML CLI lets malicious website run code locally
CVE-2026-84452 · published 1 month ago
Summary
The WinML command‑line tool before version 0.4.0 opened a local web interface that anyone could call without a password. A bad website visited by a user could tell the tool to load and run code from an attacker’s location, giving the attacker the same rights as the tool’s service account. Update to version 0.4.0 or later to close the open access.
What to do
- Update winml-cli to version 0.4.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | microsoft | winml-cli | < 0.4.0 |
| pip | – | winml-cli |
< 0.4.0 Fix: upgrade to 0.4.0
|
Original advisory text
Windows ML CLI: CORS misconfig enables localhost RCE
Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.
References
- https://github.com/microsoft/winml-cli Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-84452 Vendor Advisory
- https://github.com/advisories/GHSA-96p9-rh4f-92cf
- https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf
- https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca...
- https://pypi.org/project/winml-cli Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84452... Vendor Advisory
- https://github.com/microsoft/winml-cli/pull/1321
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.6
High
Type
CWE-942Permissive Cross-domain Security Policy with Untrusted Domains
CWE-306Missing Authentication for Critical Function
Timeline
Published2 Sep 2026
Updated9 Oct 2026
First seen2 Sep 2026
Sources
CVE-2026-84452 · NVD
CVE-2026-84452 · MITRE
GHSA-96p9-rh4f-92cf · GHSA
GHSA-96p9-rh4f-92cf · OSV
PYSEC-2026-3944 · OSV
CVE-2026-84452 · OSV
Track software like this
Free during beta