Description
X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py built a context with ssl._create_unverified_context() and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any model download, and models are fetched over HTTPS from the project's release host. Any party positioned to intercept that connection could therefore answer it with content of their own choosing. The response is written to a .part file and moved into place with os.replace, and the only post-download check, safe_check_model, validates the file's format rather than its provenance: no hash or signature is compared against an expected value. For an ONNX target the substituted file passes onnx.checker.check_model and is then used for inference, so the attacker chooses the model that produces the application's annotations. For a .pth or .pt target, which the shipped SAM2 video, YOLOE, UPN and open_vision configurations use, the check worker calls torch.load without weights_only, so a substituted file is unpickled and executes code of the attacker's choosing on PyTorch releases predating the weights_only default.
Published: 2026-08-25
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

X-AnyLabeling's model downloader builds an unverified SSL context, disabling TLS certificate checks when fetching models over HTTPS. An attacker who intercepts that pull can supply a malicious model file. The validation after download only checks format, not provenance, allowing the attacker to supply an ONNX model that predicts desired annotations or a PyTorch (.pth/.pt) model that is unpickled as code, allowing code execution. This weakness is a certificate verification bypass (CWE-295).

Affected Systems

The affected software is X-AnyLabeling from CVHub520. Versions before 4.0.0-beta.9 are vulnerable, including the 4.0.0-beta.8 release referenced by the advisory.

Risk and Exploitability

The CVSS score of 8.2 indicates high severity. Because EPSS is not available and it is currently not listed in CISA's KEV catalog, there is current uncertainty about how often this flaw is actively exploited. The likely attack vector is interception of the HTTPS model download via a man-in-the-middle or by redirecting requests to a malicious server. The lack of certificate verification means even legitimate intermediaries could supply arbitrary model content. Therefore, any environment that routinely downloads models from the project's release host is at risk, and attackers could gain remote code execution or tamper with inference results.

Generated by OpenCVE AI on August 25, 2026 at 21:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to X-AnyLabeling 4.0.0-beta.9 or later, where TLS certificate verification is restored.
  • If upgrading is not immediately possible, block outbound HTTPS traffic to the official release host and replace model downloads with local, vendor‑signed models stored on a trusted internal repository.
  • As a temporary measure, manually validate the hash or signature of downloaded models before loading them into the application.

Generated by OpenCVE AI on August 25, 2026 at 21:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Cvhub520
Cvhub520 x-anylabeling
Vendors & Products Cvhub520
Cvhub520 x-anylabeling

Tue, 25 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Description X-AnyLabeling's model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py built a context with ssl._create_unverified_context() and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any model download, and models are fetched over HTTPS from the project's release host. Any party positioned to intercept that connection could therefore answer it with content of their own choosing. The response is written to a .part file and moved into place with os.replace, and the only post-download check, safe_check_model, validates the file's format rather than its provenance: no hash or signature is compared against an expected value. For an ONNX target the substituted file passes onnx.checker.check_model and is then used for inference, so the attacker chooses the model that produces the application's annotations. For a .pth or .pt target, which the shipped SAM2 video, YOLOE, UPN and open_vision configurations use, the check worker calls torch.load without weights_only, so a substituted file is unpickled and executes code of the attacker's choosing on PyTorch releases predating the weights_only default.
Title X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Cvhub520 X-anylabeling
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-29T11:48:02.041Z

Reserved: 2026-08-25T14:32:37.763Z

Link: CVE-2026-79785

cve-icon Vulnrichment

Updated: 2026-08-25T19:01:14.651Z

cve-icon NVD

Status : Received

Published: 2026-08-25T16:17:30.690

Modified: 2026-08-25T19:16:54.607

Link: CVE-2026-79785

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:36:57Z

Weaknesses
  • CWE-295

    Improper Certificate Validation