The _load_model() function in the neural_magic_training.py script of the optimate project executes code from a module.py file located in a directory specified by the user via the --model command-line argument. Because the function uses Python's exec() on the file contents without validation, an attacker who can control the directory path can execute arbitrary Python code within the process context. This represents a CWE-94 (Improper Control of Generation of Code) vulnerability. The vulnerability was published on 2026-05-12 and carries a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network exploitable, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code remotely on the system running the vulnerable script. This can lead to complete system compromise, including full control over confidentiality, integrity, and availability of the affected system. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the vulnerable script with untrusted input for the --model argument. Restrict access to the environment where the script runs to trusted users only and validate or sanitize input paths if possible to prevent supplying malicious directories.