{"apiVersion":"1.0","identifier":"CVE-2026-79785","description":"X-AnyLabeling-s model downloader disabled TLS certificate verification. download_with_retry in anylabeling/services/auto_labeling/model.py built a context with ssl._create_unverified_context() and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any model download, and models are fetched over HTTPS from the project-s release host. Any party positioned to intercept that connection could therefore answer it with content of their own choosing. The response is written to a .part file and moved into place with os.replace, and the only post-download check, safe_check_model, validates the file-s format rather than its provenance: no hash or signature is compared against an expected value. For an ONNX target the substituted file passes onnx.checker.check_model and is then used for inference, so the attacker chooses the model that produces the application-s annotations. For a .pth or .pt target, which the shipped SAM2 video, YOLOE, UPN and open_vision configurations use, the check worker calls torch.load without weights_only, so a substituted file is unpickled and executes code of the attacker-s choosing on PyTorch releases predating the weights_only default.","publishedAt":"2026-08-25T16:17:30","lastModifiedAt":"2026-08-25T19:16:54","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79785","cvssScore":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","epssProbability":0.00176,"riskScore":0.6,"affectedProduct":"X-AnyLabeling","affectedVersions":"unknown","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-79785","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-79785","en":"https://www.redsauce.net/en/cves/CVE-2026-79785","fr":"https://www.redsauce.net/fr/cves/CVE-2026-79785","pt":"https://www.redsauce.net/pt/cves/CVE-2026-79785","de":"https://www.redsauce.net/de/cves/CVE-2026-79785","sk":"https://www.redsauce.net/sk/cves/CVE-2026-79785","el":"https://www.redsauce.net/el/cves/CVE-2026-79785"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-79785"}}