A critical vulnerability in InstructLab allows unauthenticated remote attackers to execute arbitrary code on systems running RHEL AI 3 by leveraging malicious models.

The vulnerability stems from the use of trust_remote_code=True within the linux_train.py script, which processes models from the HuggingFace Hub. This insecure configuration allows an attacker to trigger arbitrary Python code execution when a user initiates training, downloading, or generation tasks using a crafted malicious model.

The potential impact of this vulnerability is a complete system compromise, as it grants attackers the ability to execute arbitrary code with the privileges of the user running the InstructLab CLI. Given the CVSS score of 8.8, this flaw represents a significant risk to data integrity, system availability, and the confidentiality of environments utilizing RHEL AI. Unauthorized access could lead to the theft of sensitive model data or the deployment of persistent threats within the infrastructure.

Immediate Action: Apply the security updates provided by Red Hat for RHEL AI 3 immediately as detailed in the official Red Hat security advisory.

Proactive Monitoring: Review system logs for unauthorized model downloads or unusual process execution patterns initiated by the InstructLab CLI.

Compensating Controls: Restrict network access for systems running InstructLab to prevent connections to untrusted or external model repositories until patches are applied.

Public Exploit Available: Unknown

Due to the severity of the potential impact, organizations must prioritize patching their RHEL AI environments. Users should exercise extreme caution when interacting with external model repositories and ensure that software updates are deployed as soon as they are made available by the vendor.