Axolotl before 0.19.0 contains a remote code execution flaw rooted in the multipack patching mechanism, where the "trust_remote_code" flag defaults to None instead of False. This misconfiguration lets the internal security guard be bypassed, allowing malicious code to run during model loading. Based on the description, the attacker crafts a rogue Hugging Face model repository to be used as a base_model, and because the loading routine hardcodes "trust_remote_code=True" the code in that repository executes with full process privileges.

The vulnerability affects the Axolotl product delivered by Axolotl AI Cloud. Versions up to and including 0.18.0 are affected, and any system that incorporates multipack patches from external sources using the affected release is at risk.

The flaw carries a CVSS score of 8.7, classifying it as high severity. Its EPSS score is below 1 % and it is not listed in the CISA KEV catalog, suggesting a low but non‑zero likelihood of exploitation in the wild. The attack vector is remote: an adversary can supply a malicious model repository that the system treats as trusted during loading, thus executing arbitrary Python code. The impact spans confidentiality, integrity, and availability of the affected host, potentially compromising the entire application environment.