Axolotl through version 0.18.0 exposes a remote code execution flaw in the multipack patching path because the trust_remote_code flag is set to None by default instead of False. This omission bypasses the security guard that normally rejects unknown code execution. An attacker can take advantage by hosting a malicious Hugging Face model repository chosen as base_model; the repository is loaded with a hardcoded trust_remote_code=True inside AutoModelForCausalLM.from_pretrained, allowing the attacker to inject and execute arbitrary Python code.

The vulnerability affects the Axolotl AI Cloud product called Axolotl, specifically releases up to and including version 0.18.0. Systems running this version and utilizing multipack patching are in scope.

According to the CVSS assessment, the issue has a score of 8.7, indicating high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves an attacker providing a crafted Hugging Face model repository that the affected system loads automatically, thereby exploiting the default trust_remote_code setting. Given the high CVSS score and the absence of notable mitigations, the risk remains significant for affected deployments.