CVE-2026-124589

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-22

• https://github.com/lxtGH/OMG-Seg/
• https://github.com/lxtGH/OMG-Seg/issues/78
• https://github.com/user-attachments/files/33587423/poc.zip
• https://vuldb.com/cve/CVE-2026-124589
• https://vuldb.com/submit/1040376
• https://vuldb.com/vuln/433013
• https://vuldb.com/vuln/433013/cti

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124582A vulnerability was identified in WebTorrent up to 2.8.5/3.0…4.3
• CVE-2026-124584A vulnerability has been found in wummel patool 4.1.0. This …4.4
• CVE-2026-124585A vulnerability was found in Chengdu Feiyuxing Technology VW…9.9
• CVE-2026-124586A vulnerability was determined in Tencent RapidJSON 1.1.0. I…7.3
• CVE-2026-124587A vulnerability was identified in elizaOS eliza 2.0.3-beta.7…4.3
• CVE-2026-124588A security flaw has been discovered in huggingface finetrain…6.3
• CVE-2026-12459Inappropriate implementation in Serial in Google Chrome prio…6.1
• CVE-2026-124590A security vulnerability has been detected in zhangbw409 lib…7.3
• CVE-2026-124591A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affecte…5.5
• CVE-2026-124598An API key is hardcoded and retrievable from the GV-Face pac…7.5
• CVE-2026-124599The RSA cryptographic key material, including a private key …6.2
• CVE-2026-1246The ShortPixel Image Optimizer plugin for WordPress is vulne…4.9