CVE-2026-31217 - Vulnerability Analysis

Overview

Optimate contains a remote code execution caused by unsanitized execution of module.py file from user-supplied directory via --model argument in _load_model(), letting attackers execute arbitrary Python code, exploit requires attacker control of input directory.

Severity & Score

Impact

Attackers controlling input directory can execute arbitrary Python code, potentially leading to full system compromise.

Mitigation

Validate and sanitize the contents of module.py before execution or avoid using exec() on untrusted input.

References

• https://github.com/nebuly-ai/optimate
• https://www.notion.so/CVE-2026-31217-35d1e13931888179ae40dea5258d2db9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner