CVE-2026-108943
mediumA weakness has been identified in ModelTC LightX2V up to 0.5.0.
A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file lightx2v/models/runners/cosmos3/cosmos3_runner.py of the component Tokenizer. This manipulation of the argument auto_map causes code injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/ModelTC/LightX2V/ cna@vuldb.com
- https://github.com/ModelTC/LightX2V/issues/1559 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-108943 cna@vuldb.com
- https://vuldb.com/submit/997679 cna@vuldb.com
- https://vuldb.com/vuln/416768 cna@vuldb.com
- https://vuldb.com/vuln/416768/cti cna@vuldb.com
- https://github.com/ModelTC/LightX2V/issues/1559 134c704f-9b21-4f2e-91b3-4a467353bcc0