PT-2026-40066 · Undefined · Undefined

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-31228

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. The robustness evaluation function for PyTorch models uses the unsafe eval() function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without any sanitization or security restrictions. An attacker can exploit this by providing a specially crafted string that contains arbitrary Python code, which will be executed when eval() is called, leading to complete compromise of the system running the ART evaluation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-31228

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-31228 · Security Note
• https://github.com/Trusted-AI/adversarial-robustness-toolbox · Note
• https://notion.so/CVE-2026-31228-35d1e1393188817f9ab0dc4b1651dfe9 · Note