Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by InternScience

    CVE-2026-115802 (GCVE-0-2026-115802)

    Vulnerability from nvd – Published: 2026-10-24 06:30 – Updated: 2026-10-24 06:30
    VLAI
    Title
    InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
    Summary
    A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
    4.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
    CWE
    • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 83/100 over 3866 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    InternScience InternAgent Affected: 1.5.0
        cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Dem000000 (VulDB User)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "LoRA Loading"
          ],
          "product": "InternAgent",
          "vendor": "InternScience",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dem000000 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T06:30:15.142Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-425984 | InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/425984"
        },
        {
          "name": "VDB-425984 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/425984/cti"
        },
        {
          "name": "CVE-2026-115802 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-115802"
        },
        {
          "name": "Submit #1022289 | InternScience InternAgent commit fa8c3eedfa9751d3752ea6eb49220b303ac2397d (main HEAD as of 2026-07-29) Improper Input Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1022289"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/InternScience/InternAgent/issues/30"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/33260564/poc.zip"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/InternScience/InternAgent/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-23T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-23T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-23T17:12:26.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-115802",
    "datePublished": "2026-10-24T06:30:15.142Z",
    "dateReserved": "2026-10-23T15:07:13.404Z",
    "dateUpdated": "2026-10-24T06:30:15.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-115802 (GCVE-0-2026-115802)

    Vulnerability from cvelistv5 – Published: 2026-10-24 06:30 – Updated: 2026-10-24 06:30
    VLAI
    Title
    InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
    Summary
    A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
    4.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
    CWE
    • CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 83/100 over 3866 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    InternScience InternAgent Affected: 1.5.0
        cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Dem000000 (VulDB User)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:internscience:internagent:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "LoRA Loading"
          ],
          "product": "InternAgent",
          "vendor": "InternScience",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dem000000 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T06:30:15.142Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-425984 | InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/425984"
        },
        {
          "name": "VDB-425984 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/425984/cti"
        },
        {
          "name": "CVE-2026-115802 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-115802"
        },
        {
          "name": "Submit #1022289 | InternScience InternAgent commit fa8c3eedfa9751d3752ea6eb49220b303ac2397d (main HEAD as of 2026-07-29) Improper Input Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1022289"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/InternScience/InternAgent/issues/30"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/user-attachments/files/33260564/poc.zip"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/InternScience/InternAgent/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-23T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-23T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-23T17:12:26.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-115802",
    "datePublished": "2026-10-24T06:30:15.142Z",
    "dateReserved": "2026-10-23T15:07:13.404Z",
    "dateUpdated": "2026-10-24T06:30:15.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}