CVE-2026-108943: Code Injection in ModelTC LightX2V

This vulnerability affects ModelTC LightX2V up to version 0.5.0 in the AutoTokenizer.from_pretrained function of the Tokenizer component. The issue is caused by improper handling of the auto_map argument, which can be manipulated to inject arbitrary code. The attack vector is local execution, meaning an attacker must have local access to the system to exploit the flaw. Public exploit code has been released, increasing the risk of exploitation. The vendor has been informed but has not yet issued a response. A patch exists to remediate the vulnerability.

Successful exploitation allows an attacker with local access to execute arbitrary code within the context of the vulnerable application. This could lead to unauthorized actions or compromise of the affected system. However, the attack requires local privileges and does not involve network-based exploitation, limiting the attack surface. The CVSS score of 4.8 reflects a medium severity level.

A patch is available to fix this vulnerability. Users of ModelTC LightX2V versions 0.1 through 0.5.0 should apply the official patch as soon as possible to mitigate the risk of code injection. Since the vendor has not yet responded publicly, users should monitor the vendor's advisory channels for the patch release and apply it promptly. Until patched, restrict local access to trusted users only.