CVE-2026-108944
4.8MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-94
Impact
A local attacker can execute arbitrary code with the privileges of the running application if they trick a user into loading a malicious configuration. They need local system access and user interaction to trigger the parsing of the crafted configuration file.
Root cause
The get_obj_from_str function in src/utils/model_utils.py unsafely evaluates or dynamically imports the user-controlled 'Target' argument during model instantiation, leading to code injection.
Affected systems
RAE git repository commit history up to commit a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Fix & remediation
No official fix exists yet. Restrict file permissions on model configuration files to prevent local tampering, or audit src/utils/model_utils.py locally to sanitize or remove dynamic resolution from the 'Target' parameter.
$ git rev-parse HEADAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of the file src/utils/model_utils.py of the component Config-Driven Model Instantiation. Such manipulation of the argument Target leads to code injection. The attack must be carried out locally. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.