Windows ML CLI exposes a HTTP API on localhost that performs no authentication and sets the CORS allow_origins header to a wildcard. A page loaded in the victim’s browser can call the /v1/cli/build or /v1/cli/config endpoints, pass trust_remote_code=true, and cause the CLI to download and execute Python code from an attacker‑controlled model repository. This results in arbitrary code execution as the user who runs the WinML CLI service, allowing full compromise of the host system.

All installations of Microsoft Windows ML CLI prior to version 0.4.0 are affected. The tool is intended to run on local machines, developer workstations, or build servers where the service is started without proper authentication.

The vulnerability carries a CVSS score of 8.6, indicating high severity. The EPSS score is not available, so the exact exploitation probability is unknown, but the open API and wildcard CORS enable an attacker who can persuade the user to load a malicious webpage to target the local service. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the missing authentication (CWE‑306) and unsafe trust_remote_code handling (CWE‑942) to gain full control of the host running the WinML CLI service.