axolotl-ai-cloud CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH axolotl-ai-cloud CVE published 2026-09-05

CVE-2026-86169

CVE-2026-86169 is a remote code execution vulnerability in Axolotl through version 0.18.0. The vulnerability allows attackers to execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained. This occurs because the multipack patch path security guard is bypassed [truncated]