Technical impact
OpenMed versions prior to 1.5.2 are vulnerable to remote code execution when a user supplies a model_name that contains a slash. The privacy‑filter dispatcher performs a broad substring match on this parameter, allowing values such as attacker/foo-privacy-filter-bar to be interpreted as a path that loads Hugging Face models with trust_remote_code enabled. An unauthenticated attacker can upload a malicious repository that includes custom Transformers code in auto_map or tokenizer_config.json; that code is imported and executed with the privileges of the OpenMed process. This flaw enables an attacker to run arbitrary code, compromising confidentiality, integrity, and availability of the affected system.
Affected Systems
The issue affects the OpenMed project by maziyarpanahi in all releases before version 1.5.2. No specific sub‑versions are listed beyond the pre‑1.5.2 boundary.
Risk and Exploitability
The flaw has a CVSS score of 9.3, indicating Critical severity, and is exploitable by any unauthenticated user who can send a request with a crafted model_name. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. The wide latitude of the substring match and the implicit trust_remote_code flag create a clear attack vector that requires no authentication or privileged input, making exploitation highly likely if the software remains unpatched.
Github GHSA