H3-2026-1053¶
LocalAI TRL Backend Inline Reward Function Remote Code Execution Vulnerability
| Category | VULNERABILITY |
| Base Score | 9.8 |
Description¶
Mudler LocalAI contains a code injection vulnerability in the /api/fine-tuning/jobs endpoint when using the TRL backend. The endpoint accepts inline Python reward function code that is executed via exec() against a restrictive _SAFE_BUILTINS allowlist, which can be bypassed through CPython introspection techniques such as ().__class__.__bases__[0].__subclasses__() to reach os.system. The fine-tuning endpoint is unauthenticated by default, requiring only network access to the LocalAI API. The vulnerability exists because the allowlist-based sandboxing approach is insufficient to prevent arbitrary Python object traversal and system command invocation.
Impact¶
Remote attackers can execute arbitrary shell commands as the backend process user, which is often root in containerized deployments. Full system compromise, data exfiltration, and lateral movement are possible. Organizations deploying LocalAI for AI/ML workloads in cloud or on-premises environments are at risk. The vulnerability affects any network-accessible LocalAI instance with the TRL backend enabled.