PT-2026-40056 · Nebuly · Optimate

Published 2026-05-12 · Updated 2026-05-26 · CVE-2026-31217

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions optimate versions prior to commit a6d302f912b481c94370811af6b11402f51d377f

Description The load model() function in the neural magic training.py script allows arbitrary code execution. When a directory path is supplied via the --model command-line argument, the function reads a module.py file from that directory and executes its contents using the exec() function. Because the content of the file is not validated or sanitized, an attacker who controls the input directory can execute arbitrary Python code within the process context.

Recommendations Update to a version of optimate released after commit a6d302f912b481c94370811af6b11402f51d377f. As a temporary workaround, avoid providing untrusted directory paths to the --model command-line argument.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-31217

Affected Products

Optimate

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-31217 · Security Note
• https://github.com/nebuly-ai/optimate · Note
• https://notion.so/CVE-2026-31217-35d1e13931888179ae40dea5258d2db9 · Note
• https://t.me/cveNotify/164714 · Telegram Post