CVE-2026-31226
Last modified
CVE-2026-31226 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (CWE-78) in its HDFS file operation utilities. The vulnerability arises from the unsafe construction and execution of shell commands via os.system() without proper input sanitization or escaping. EPSS estimates a 1.16% chance of exploitation in the next 30 days.
Description
The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (CWE-78) in its HDFS file operation utilities. The vulnerability arises from the unsafe construction and execution of shell commands via os.system() without proper input sanitization or escaping. User-controlled input (such as file paths) is directly interpolated into shell command strings using f-strings within the _copy() function. An attacker can inject arbitrary OS commands by supplying a specially crafted path parameter through the Hydra configuration framework. This leads to remote code execution with the privileges of the user running the TinyZero training process.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-31226?
How severe is CVE-2026-31226?
How do I fix CVE-2026-31226?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-31220PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are…9.8
- CVE-2026-31221PyTorch-Lightning versions 2.6.0 and earlier contain an inse…7.8
- CVE-2026-31222The snorkel library thru v0.10.0 contains an insecure deseri…8.8
- CVE-2026-31223The snorkel library thru v0.10.0 contains a critical insecur…8.8
- CVE-2026-31224The snorkel library thru v0.10.0 contains an insecure deseri…8.8
- CVE-2026-31225The superduper project thru v0.10.0 contains a critical remo…8.8
- CVE-2026-31228The Adversarial Robustness Toolbox (ART) thru 1.20.1 contain…9.8
- CVE-2026-31229The Adversarial Robustness Toolbox (ART) thru 1.20.1 contain…9.8
- CVE-2026-31230The Adversarial Robustness Toolbox (ART) thru 1.20.1 contain…9.8
- CVE-2026-31231Cognee thru v0.4.0 contains a critical remote code execution…9.8
- CVE-2026-31232The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996…8.8
- CVE-2026-31233Guardrails AI thru 0.6.7 contains a code injection vulnerabi…9.8
Are you affected by CVE-2026-31226?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST