PT-2026-40065 · Undefined · Undefined

Published 2026-05-12 · Updated 2026-05-19 · CVE-2026-31226

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TinyZero versions prior to commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839

Description Command injection exists in the HDFS file operation utilities due to the unsafe construction and execution of shell commands via the os.system() function without proper input sanitization or escaping. User-controlled input, such as file paths, is directly interpolated into shell command strings using f-strings within the copy() function. An attacker can inject arbitrary OS commands by providing a specially crafted path parameter through the Hydra configuration framework, leading to remote code execution with the privileges of the user running the training process.

Recommendations Update TinyZero to a version beyond commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839. As a temporary workaround, restrict or avoid using the copy() function and the path parameter within the Hydra configuration framework until the update is applied.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-31226

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-31226 · Security Note
• https://github.com/Jiayi-Pan/TinyZero · Note
• https://t.me/cveNotify/164080 · Telegram Post
• https://notion.so/CVE-2026-31226-35d1e139318881d19af5d63095c74579 · Note