CVE-2026-115802: InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-24 · updated 2026-10-29
Weakness: CWE-829

Description

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

InternScience InternAgent: 1.5.0

References

https://github.com/InternScience/InternAgent/
https://github.com/InternScience/InternAgent/issues/30
https://github.com/user-attachments/files/33260564/poc.zip
https://vuldb.com/cve/CVE-2026-115802
https://vuldb.com/submit/1022289
https://vuldb.com/vuln/425984
https://vuldb.com/vuln/425984/cti

Get alerted when CVE-2026-115802 or the next vulnerability affects your stack