Instructlab vulnerabilities

2 known vulnerabilities in Instructlab from Red Hat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Red Hat Enterprise Linux AI (RHEL AI) 3: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2026-6859Apr 22, 2026Red Hat

  A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/gene

• 7.1 High severity

  Red Hat Enterprise Linux AI (RHEL AI) 3: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-6855Apr 22, 2026Red Hat

  A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on th