InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
Impact
InternScience InternAgent 1.5.0 has a weakness in the LoRA Loading component's experiment.py file, where the train function can include functionality from an untrusted control sphere via the base_model_name_or_path argument. The attack may be initiated remotely.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
InternScience · VulDB
InternAgent
1 range
InternScience · VulDB
InternAgent
Compare with this publisher’s ranges. This does not inspect your installation.
affected
1.5.0
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*Original source description
A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115802View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.