CVE-2026-47117: OpenMed RCE Vulnerability

CVE-2026-47117 Overview

CVE-2026-47117 is a remote code execution vulnerability in OpenMed versions prior to 1.5.2. The flaw resides in the personally identifiable information (PII) privacy-filter model loading path. The privacy-filter dispatcher performs broad substring matching on the user-supplied model_name parameter. This routing logic loads Hugging Face models with trust_remote_code=True, enabling arbitrary code execution. An unauthenticated attacker can supply a malicious model repository that imports custom Transformers code via auto_map in config.json or tokenizer_config.json. The injected code executes with the privileges of the OpenMed service process. The vulnerability is tracked under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can achieve remote code execution on OpenMed services by supplying a crafted Hugging Face model identifier that bypasses substring filtering and executes attacker-controlled Python code.

Affected Products

OpenMed versions before 1.5.2
OpenMed deployments exposing the PII privacy-filter endpoint
Services loading Hugging Face models through the OpenMed dispatcher

Discovery Timeline

2026-06-02 - CVE-2026-47117 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-47117

Vulnerability Analysis

The vulnerability stems from the OpenMed privacy-filter dispatcher applying broad substring matching to the model_name request parameter. Any value containing the substring privacy-filter routes through the privileged loading path. That path invokes Hugging Face from_pretrained style loaders with trust_remote_code=True. The flag instructs the Transformers library to import Python modules referenced by the model repository.

An attacker crafts a model identifier such as attacker/foo-privacy-filter-bar. The substring match treats this as a legitimate privacy-filter model and downloads the remote repository. The repository's config.json or tokenizer_config.json declares custom classes through the auto_map field. Transformers imports and executes those modules during model instantiation, granting the attacker code execution under the OpenMed service account.

Root Cause

The root cause is unsafe trust delegation combined with weak input validation. Substring matching is insufficient to bind a request to a vetted model namespace. Coupling that loose check with trust_remote_code=True converts an identifier-validation gap into arbitrary code import. Refer to the VulnCheck Remote Code Execution Advisory for the upstream analysis.

Attack Vector

The attack is unauthenticated and network-reachable. An attacker hosts a malicious model repository on a public model registry. The attacker then issues a request to the OpenMed PII endpoint with a model_name value containing the privacy-filter substring and pointing to the attacker-controlled namespace. OpenMed fetches the repository and executes the embedded Python through the Transformers auto_map import chain. No user interaction is required.

Detection Methods for CVE-2026-47117

Indicators of Compromise

Outbound network connections from OpenMed hosts to untrusted Hugging Face namespaces or mirror endpoints.
Unexpected child processes spawned by the OpenMed service interpreter (python, gunicorn, uvicorn).
New Python modules cached under ~/.cache/huggingface/modules/transformers_modules/ referencing unknown repositories.
HTTP request logs containing model_name values with embedded privacy-filter substrings from external namespaces.

Detection Strategies

Inspect application logs for model_name parameters not matching an explicit allowlist of approved repositories.
Alert on Transformers loader invocations where trust_remote_code=True is observed at runtime.
Correlate OpenMed process telemetry with outbound DNS for huggingface.co and CDN endpoints during inference requests.

Monitoring Recommendations

Capture file integrity events for the Hugging Face module cache directory used by the OpenMed runtime.
Monitor for new outbound TLS connections initiated by the OpenMed worker processes to non-allowlisted hosts.
Track command-line execution and parent-child process relationships for the OpenMed service to surface post-exploitation activity.

How to Mitigate CVE-2026-47117

Immediate Actions Required

Upgrade OpenMed to version 1.5.2 or later, which addresses the dispatcher routing logic. See the GitHub Release v1.5.2.
Restrict network egress from OpenMed hosts to an allowlist of approved model registry endpoints.
Audit historical request logs for model_name values containing privacy-filter substrings tied to untrusted namespaces.

Patch Information

The fix is delivered in OpenMed 1.5.2. Review the patch commit at the GitHub Commit Update and the maintainer discussion in the GitHub Pull Request Discussion. The change replaces broad substring matching with exact identifier validation and removes implicit trust_remote_code=True behavior on the privacy-filter path.

Workarounds

Place OpenMed behind an authenticated reverse proxy until patching is complete to remove unauthenticated exposure.
Run the OpenMed service under a dedicated low-privilege account with no write access to system directories.
Set the environment variable HF_HUB_DISABLE_IMPLICIT_TOKEN=1 and pre-stage approved models locally to avoid runtime downloads.
Configure the runtime to reject any model_name parameter that does not match a hardcoded allowlist of vetted repositories.

bash

# Configuration example: enforce model allowlist via reverse proxy
# nginx snippet rejecting external model identifiers on the PII endpoint
location /pii/ {
    if ($arg_model_name !~* "^(openmed/(pii-privacy-filter-en|pii-privacy-filter-multi))$") {
        return 400;
    }
    proxy_pass http://openmed_upstream;
}