CVE-2026-31230: Adversarial Robustness Toolbox RCE Flaw

CVE-2026-31230 Overview

CVE-2026-31230 is a command-line argument injection vulnerability affecting the Adversarial Robustness Toolbox (ART) through version 1.20.1. The flaw resides in the Kubeflow component script robustness_evaluation_fgsm_pytorch.py, which parses string values from the --clip_values and --input_shape arguments using the unsafe Python eval() function. An attacker who controls these arguments through pipeline configuration or automated scripts can inject arbitrary Python code that executes on the host running the ART evaluation. The weakness is categorized under CWE-88: Improper Neutralization of Argument Delimiters in a Command.

Critical Impact

Remote attackers can achieve arbitrary code execution on systems running ART evaluations by injecting Python expressions into Kubeflow pipeline arguments.

Affected Products

• Adversarial Robustness Toolbox (ART) versions up to and including 1.20.1
• ART Kubeflow component robustness_evaluation_fgsm_pytorch.py
• Machine learning pipelines integrating the affected ART Kubeflow script

Discovery Timeline

• 2026-05-12 - CVE-2026-31230 published to the National Vulnerability Database
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-31230

Vulnerability Analysis

The Adversarial Robustness Toolbox is an open-source library maintained by the Trusted-AI project for evaluating the robustness of machine learning models. The Kubeflow integration script robustness_evaluation_fgsm_pytorch.py accepts user-controlled string arguments to configure adversarial evaluation parameters. Instead of using a safe parser such as ast.literal_eval() or json.loads(), the script invokes Python's built-in eval() directly on the supplied string values.

Because eval() executes any valid Python expression, the parsing step becomes a code execution primitive. Any caller able to influence the --clip_values or --input_shape arguments can supply a payload that runs with the privileges of the ART process. In Kubeflow deployments, this typically means execution inside a pipeline container with access to model artifacts, training data, and cluster credentials mounted into the pod.

Root Cause

The root cause is the use of eval() to convert command-line strings into Python objects. The function performs no validation, allowlisting, or sandboxing on the input. Argument values are passed unchanged from the pipeline manifest to eval(), satisfying the conditions for [CWE-88] argument injection that escalates into arbitrary code execution.

Attack Vector

Exploitation requires the attacker to control the values of --clip_values or --input_shape passed to the affected script. Common paths include modifying a Kubeflow pipeline definition, tampering with an automation script in source control, or submitting a malicious pipeline run through an exposed Kubeflow API. The vulnerability is exploitable over the network with no authentication or user interaction when the pipeline interface accepts external submissions.

A payload supplied through either argument is passed to eval() and evaluates as Python code. Attackers commonly chain expressions that invoke __import__('os').system(...) or equivalent constructs to spawn shells, exfiltrate secrets, or pivot inside the Kubernetes cluster. Refer to the ART project repository for component source and remediation status.

Detection Methods for CVE-2026-31230

Indicators of Compromise

• Unexpected child processes spawned by python processes executing robustness_evaluation_fgsm_pytorch.py
• Outbound network connections from Kubeflow pipeline pods to unrecognized hosts during ART evaluation steps
• Pipeline run parameters where clip_values or input_shape contain characters such as __import__, os.system, backticks, or shell metacharacters

Detection Strategies

• Inspect Kubeflow pipeline manifests and run histories for ART steps and flag any non-numeric content in --clip_values and --input_shape arguments.
• Monitor process creation telemetry on ML workload nodes for sh, bash, curl, or wget invoked as descendants of the ART evaluation script.
• Audit container images and Python environments for ART versions at or below 1.20.1 using software composition analysis.

Monitoring Recommendations

• Forward Kubernetes audit logs and pod stdout/stderr to a centralized analytics platform and alert on suspicious child processes under ART pipeline containers.
• Apply runtime policies that flag execution of interactive shells or network utilities inside data science pipeline pods.
• Track EPSS scoring updates for CVE-2026-31230 and re-evaluate exposure if exploit activity changes.

How to Mitigate CVE-2026-31230

Immediate Actions Required

• Identify all instances of ART 1.20.1 and earlier in CI/CD systems, container registries, and Kubeflow deployments.
• Restrict who can submit or modify Kubeflow pipelines that invoke robustness_evaluation_fgsm_pytorch.py until the component is patched or replaced.
• Treat any historical pipeline runs with unusual --clip_values or --input_shape values as potentially compromised and rotate associated secrets.

Patch Information

At the time of NVD publication, consult the Adversarial Robustness Toolbox GitHub repository for the latest releases and security fixes addressing CVE-2026-31230. Upgrade to a version where eval() is replaced with a safe parser such as ast.literal_eval() for the affected arguments.

Workarounds

• Replace the affected script locally by substituting eval() with ast.literal_eval() for the --clip_values and --input_shape arguments.
• Validate and allowlist argument values in pipeline templates so that only numeric tuples or lists are accepted before the script is invoked.
• Run ART evaluation containers under least-privilege service accounts with egress network restrictions to limit blast radius if exploitation occurs.

# Configuration example: enforce safe parsing in a local patch
# Replace the unsafe eval() call inside robustness_evaluation_fgsm_pytorch.py
# from:
#   clip_values = eval(args.clip_values)
#   input_shape = eval(args.input_shape)
# to:
import ast
clip_values = ast.literal_eval(args.clip_values)
input_shape = ast.literal_eval(args.input_shape)