CVE-2026-84452: 
Python vulnerability analysis and mitigation

CVE-2026-84452 is a CORS misconfiguration vulnerability in Microsoft's Windows ML CLI (winml-cli) that enables arbitrary remote code execution via a malicious website. The serve/cli_api.py component exposes all WinML CLI commands over an unauthenticated localhost HTTP API with a wildcard allow_origins=["*"] CORS policy, allowing any website visited by the user to send cross-origin requests to the local server. Affected versions are all releases prior to 0.4.0 of the winml-cli pip package. It carries a CVSS v4.0 base score of 8.6 (High) (Github Advisory, Feedly). The advisory was published on August 28, 2026, with a patch released in version 0.4.0 on September 8, 2026.

The root cause is a combination of two weaknesses: CWE-306 (Missing Authentication for Critical Function) and CWE-942 (Permissive Cross-domain Policy with Untrusted Domains). The cli_api.py component (line 150) and app.py (line 219) both configure allow_origins=["*"], which nullifies the security boundary provided by binding to 127.0.0.1. Any website loaded in the victim's browser can issue cross-origin POST requests to /v1/cli/build or /v1/cli/config with trust_remote_code: true in the JSON body; this value is passed without validation as the --trust-remote-code flag, ultimately reaching AutoConfig.from_pretrained(..., trust_remote_code=True) in src/winml/modelkit/loader/_autoconfig.py, which causes the transformers library to import and execute arbitrary Python code from an attacker-controlled model repository. Because the payload executes at module import time, even a failed command (non-zero exit_code) does not prevent code execution (Github Advisory, Security Advisory).

Successful exploitation results in arbitrary code execution as the user running the winml-cli serve process, granting full confidentiality, integrity, and availability impact on the affected system. An attacker can read sensitive files, write or delete data, install persistent malware, or use the compromised host as a pivot point for lateral movement within the network. No authentication or special privileges are required from the attacker — only the victim must have the winml-cli serve process running and visit a malicious webpage (Github Advisory).

A proof-of-concept (PoC) exploit with full reproduction steps is publicly documented in the GitHub Security Advisory, including a working hostile model repository and server setup script (Github Advisory). The NVD SSVC assessment classifies exploitation as "poc" and the attack as non-automatable (requires active user interaction — visiting a malicious site). The EPSS score is approximately 0.945%, indicating a relatively low but non-negligible probability of exploitation in the wild. No in-the-wild exploitation or threat actor attribution has been reported as of the advisory date, and the vulnerability is not listed in the CISA KEV catalog.

1. Set up a malicious model repository: Create a directory (e.g., /tmp/poc/evil/pwn/) containing a config.json that maps AutoConfig to a custom class, and a configuration_pwn.py file with module-level Python payload code (e.g., writing proof-of-execution to a file, spawning a reverse shell, or exfiltrating data).
2. Host the malicious model: Serve the repository locally or remotely (e.g., via a local HTTP server or a public model hub) so it is accessible as a model path or identifier.
3. Craft a malicious webpage: Create an HTML page with JavaScript that sends a cross-origin POST request to http://127.0.0.1:8000/v1/cli/build (or /v1/cli/config) with a JSON body such as {"model": "<path-or-id-to-evil-repo>", "trust_remote_code": true}.
4. Lure the victim: Deliver the malicious webpage to a user who has the winml-cli serve process running on their machine (e.g., via phishing, malvertising, or a compromised site).
5. Trigger code execution: When the victim's browser loads the page, the JavaScript fires the cross-origin request. The wildcard CORS policy allows it; the server passes trust_remote_code=True to AutoConfig.from_pretrained(), which imports the attacker's Python module, executing the payload as the server user — regardless of the command's exit code (Github Advisory, Security Advisory).

• Network: Unexpected HTTP POST requests to http://127.0.0.1:8000/v1/cli/build or http://127.0.0.1:8000/v1/cli/config originating from a browser process with a cross-origin Origin header (e.g., Origin: http://attacker.com); outbound connections from the winml-cli server process to unknown external hosts or model repositories.
• Logs: Uvicorn/FastAPI access logs showing POST requests to /v1/cli/build or /v1/cli/config with trust_remote_code=true in the request body; Python transformers library logs indicating loading of an unexpected or external model repository.
• File System: Unexpected files written by the winml-cli process (e.g., proof-of-execution markers, web shells, or scripts in user-writable directories); new or modified Python files in model cache directories (e.g., ~/.cache/huggingface/).
• Process: Unusual child processes spawned by the winml-cli Python process (e.g., bash, sh, curl, wget, python3) with unexpected arguments or network connections (Github Advisory).

Upgrade winml-cli to version 0.4.0 or later, which replaces the wildcard CORS policy with a SameOriginMiddleware that enforces same-origin request validation and restricts /v1/cli, /v1/ep (POST), and /v1/models (POST/DELETE) routes to loopback-only clients. The fix also adds a _require_remote_code_execution_allowed() guard in _autoconfig.py and hf.py that blocks HTTP-triggered trust_remote_code requests, and disables proxy header trust (proxy_headers=False) to prevent spoofing (PR #1321, Commit f4073e0). As an interim workaround for users unable to upgrade immediately, avoid running the winml-cli serve process while browsing untrusted websites, or use a firewall rule to block external access to port 8000.

The vulnerability was reported by researcher "timenick" (Zhipeng Wang) and addressed via PR #1321, which underwent multiple rounds of security review by Microsoft collaborators before being merged on August 21, 2026 (PR #1321). Reviewers noted additional bypass vectors during the review process, including trusted proxy header spoofing and origin-less HTTP client paths, all of which were addressed before the final merge. The advisory was noted on Bluesky and tracked by several vulnerability aggregators shortly after publication, but no major media coverage or broad community discussion has been identified.