CVE-2026-79785: X-AnyLabeling Model Downloader RCE Vulnerability

CVE-2026-79785 Overview

CVE-2026-79785 affects X-AnyLabeling versions prior to v4.0.0-beta.9. The download_with_retry function in anylabeling/services/auto_labeling/model.py disabled TLS certificate verification by building a context with ssl._create_unverified_context() and passing it to urllib.request.urlopen. Neither the certificate chain nor the hostname is validated during model downloads. A network-positioned attacker can substitute arbitrary model files, which the application then loads for inference. The flaw is classified under CWE-295: Improper Certificate Validation.

Critical Impact
Attackers who intercept model download traffic can deliver malicious .pth or .pt files that execute arbitrary Python code through torch.load without weights_only, or substitute ONNX models that alter application annotations.

Affected Products

X-AnyLabeling versions prior to v4.0.0-beta.9
PyPI package x-anylabeling-cvhub (pre-patch releases)
Shipped SAM2 video, YOLOE, UPN, and open_vision configurations that use .pth or .pt model targets

Discovery Timeline

2026-08-25 - CVE-2026-79785 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79785

Vulnerability Analysis

The download_with_retry function fetches models over HTTPS from the project's release host but suppresses TLS verification. Because ssl._create_unverified_context() is passed to urlopen, any intermediary capable of intercepting the connection can respond with attacker-controlled content. The response is written to a .part file and moved into place with os.replace.

The only post-download validation, safe_check_model, inspects the file format rather than its provenance. No hash or signature is compared against an expected value. For ONNX targets, onnx.checker.check_model accepts the substituted file and passes it directly to inference. The attacker therefore controls the model that produces the application's annotations.

For .pth or .pt targets, the check worker calls torch.load without weights_only=True. On PyTorch releases predating the weights_only default, deserialization unpickles the attacker's payload and executes arbitrary code in the labeling process.

Root Cause

The root cause is CWE-295: Improper Certificate Validation. The downloader explicitly constructs an unverified SSL context, bypassing certificate chain and hostname checks that would otherwise detect a substituted server. Combined with the absence of cryptographic integrity checks on downloaded artifacts, the application trusts any endpoint that answers the HTTPS connection.

Attack Vector

An attacker positioned on the network path between the X-AnyLabeling client and its release host, such as through ARP spoofing, DNS poisoning, malicious Wi-Fi, or upstream infrastructure compromise, responds to model download requests with a crafted .pt or .pth file. When the application loads the file via torch.load, the embedded pickle payload executes with the privileges of the labeling user.

python

# Security patch in anylabeling/services/auto_labeling/model.py
# Commit 52f7c30: enforce TLS verification for model downloads
 from urllib.parse import urlparse
 from urllib.error import URLError
 
-import ssl
-
 import socket
 
 socket.setdefaulttimeout(240)  # Prevent timeout when downloading models

Source: GitHub Commit 52f7c30. The patch removes the ssl import used to build the unverified context, restoring default TLS certificate validation for all model download requests.

Detection Methods for CVE-2026-79785

Indicators of Compromise

Unexpected .part files or newly written model files under the X-AnyLabeling model cache directory outside of announced upgrade windows.
Outbound HTTPS connections from the labeling process to hosts other than the official X-AnyLabeling GitHub release infrastructure.
Child processes spawned by the Python interpreter running X-AnyLabeling immediately after a model load event.

Detection Strategies

Inspect installed X-AnyLabeling versions across workstations and flag any release earlier than v4.0.0-beta.9.
Hunt for process telemetry showing the labeling application executing shells, PowerShell, or network utilities shortly after startup or model download.
Compare local model file hashes against known-good release artifacts published by the maintainer.

Monitoring Recommendations

Monitor endpoint DNS and TLS telemetry for resolution of GitHub release hosts followed by connections to unexpected IP addresses or self-signed certificates.
Alert on torch.load or Python child-process behavior originating from data-labeling workstations.
Track file writes to model cache paths and correlate with authorized administrator activity.

How to Mitigate CVE-2026-79785

Immediate Actions Required

Upgrade X-AnyLabeling to v4.0.0-beta.9 or later on all workstations that download or load models.
Re-download any previously fetched .pt, .pth, or .onnx models over a verified TLS channel and validate integrity before use.
Isolate labeling workstations that show signs of malicious model execution and rotate credentials accessible from those hosts.

Patch Information

The fix is delivered in GitHub Release v4.0.0-beta.9 via commit 52f7c30. The patch removes the unverified SSL context so urllib.request.urlopen uses default certificate validation. Refer to the VulnCheck Advisory for X-AnyLabeling for advisory details and the PyPI package for X-AnyLabeling for updated distributions.

Workarounds

Restrict model downloads to trusted networks and route traffic through a proxy that enforces TLS certificate validation.
Manually download models from the official release page over a verified connection and place them into the model cache before launching the application.
Upgrade PyTorch to a version where torch.load defaults to weights_only=True to reduce the impact of a substituted .pt or .pth file.

bash

# Upgrade to the patched X-AnyLabeling release
pip install --upgrade "x-anylabeling-cvhub>=4.0.0b9"

# Verify installed version
pip show x-anylabeling-cvhub | grep -i version