{"schema_version":"2","view":"grouped","data":[{"id":56282,"cve_ids":["CVE-2026-115802"],"payload":{"kind":"advisory","title":"InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere","summary":"A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.","evidence":"cve:CVE-2026-115802","products":[{"name":{"value":"InternAgent","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115802","aliases":["CVE-2026-115802"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*"],"vendor":"InternScience","modules":["LoRA Loading"],"product":"InternAgent","versions":[{"status":"affected","version":"1.5.0"}]}],"modified":"2026-10-24T06:30:15.142Z","provider":"cve","references":["https://vuldb.com/vuln/425984","https://vuldb.com/vuln/425984/cti","https://vuldb.com/cve/CVE-2026-115802","https://vuldb.com/submit/1022289","https://github.com/InternScience/InternAgent/issues/30","https://github.com/user-attachments/files/33260564/poc.zip","https://github.com/InternScience/InternAgent/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T06:30:15.142Z"}}},"related_cves":[{"value":"CVE-2026-115802","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d925c0e1-a88c-43ff-9bb1-319c86d82443","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115802","advisory_id":"d925c0e1-a88c-43ff-9bb1-319c86d82443","event_types":["advisory"],"published_at":"2026-10-25T16:11:29.514474+00:00","technologies":["core-cve","internagent"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:30:15.142+00:00","detail_url":"/advisories/advisory%3Ad925c0e1-a88c-43ff-9bb1-319c86d82443","group":{"id":"advisory:d925c0e1-a88c-43ff-9bb1-319c86d82443","revision":1,"primary_event_id":55805,"change":"published","superseded_by":[],"changed":{"id":55805,"cve_ids":["CVE-2026-115802"],"payload":{"kind":"advisory","title":"InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere","summary":"A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.","evidence":"cve:CVE-2026-115802","products":[{"name":{"value":"InternAgent","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115802","aliases":["CVE-2026-115802"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*"],"vendor":"InternScience","modules":["LoRA Loading"],"product":"InternAgent","versions":[{"status":"affected","version":"1.5.0"}]}],"modified":"2026-10-24T06:30:15.142Z","provider":"cve","references":["https://vuldb.com/vuln/425984","https://vuldb.com/vuln/425984/cti","https://vuldb.com/cve/CVE-2026-115802","https://vuldb.com/submit/1022289","https://github.com/InternScience/InternAgent/issues/30","https://github.com/user-attachments/files/33260564/poc.zip","https://github.com/InternScience/InternAgent/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T06:30:15.142Z"}}},"related_cves":[{"value":"CVE-2026-115802","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d925c0e1-a88c-43ff-9bb1-319c86d82443","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115802","advisory_id":"d925c0e1-a88c-43ff-9bb1-319c86d82443","event_types":["advisory"],"published_at":"2026-10-25T16:11:29.514474+00:00","technologies":["core-cve","internagent"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:30:15.142+00:00","detail_url":"/events/55805"},"members":[{"id":55805,"cve_ids":["CVE-2026-115802"],"payload":{"kind":"advisory","title":"InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere","summary":"A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.","evidence":"cve:CVE-2026-115802","products":[{"name":{"value":"InternAgent","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115802","aliases":["CVE-2026-115802"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*"],"vendor":"InternScience","modules":["LoRA Loading"],"product":"InternAgent","versions":[{"status":"affected","version":"1.5.0"}]}],"modified":"2026-10-24T06:30:15.142Z","provider":"cve","references":["https://vuldb.com/vuln/425984","https://vuldb.com/vuln/425984/cti","https://vuldb.com/cve/CVE-2026-115802","https://vuldb.com/submit/1022289","https://github.com/InternScience/InternAgent/issues/30","https://github.com/user-attachments/files/33260564/poc.zip","https://github.com/InternScience/InternAgent/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T06:30:15.142Z"}}},"related_cves":[{"value":"CVE-2026-115802","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d925c0e1-a88c-43ff-9bb1-319c86d82443","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115802","advisory_id":"d925c0e1-a88c-43ff-9bb1-319c86d82443","event_types":["advisory"],"published_at":"2026-10-25T16:11:29.514474+00:00","technologies":["core-cve","internagent"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T06:30:15.142+00:00","detail_url":"/events/55805"}]}}],"next_after":56282,"next_before":56282}