CVE-2026-47117 is a critical remote code execution vulnerability in OpenMed before version 1.5.2. The issue is due to improper control of code generation in the privacy-filter dispatcher, which uses broad substring matching on the model_name parameter. This allows an attacker to route requests to load Hugging Face models with trust_remote_code=True, enabling execution of attacker-supplied code embedded in model configuration files (auto_map in config.json or tokenizer_config.json). The vulnerability can be exploited remotely without authentication, resulting in execution of arbitrary code with the OpenMed service's privileges.

An unauthenticated remote attacker can execute arbitrary code on the OpenMed server by supplying a specially crafted model_name parameter that causes loading of malicious Hugging Face models. This leads to full compromise of the OpenMed service process, potentially allowing data theft, service disruption, or further network penetration. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects OpenMed versions prior to 1.5.2, upgrading to version 1.5.2 or later is recommended once an official fix is released. Until then, restrict access to the model loading functionality and avoid using untrusted model_name inputs to mitigate risk.