CVE-2026-47117 is a critical remote code execution vulnerability in the OpenMed software prior to version 1.5.2. The issue is in the PII privacy-filter model loading path where the dispatcher uses broad substring matching on the user-supplied model_name parameter. This allows an attacker to craft a model_name that routes to loading Hugging Face models with the trust_remote_code flag set to true. By supplying a malicious model repository containing custom Transformers code via auto_map in config.json or tokenizer_config.json, an unauthenticated attacker can execute arbitrary code with the privileges of the OpenMed service process. The vulnerability has a CVSS 4.0 score of 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can achieve remote code execution on the system running OpenMed by exploiting this vulnerability. This allows execution of arbitrary code with the privileges of the OpenMed service process, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability with high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.5.2, upgrading to version 1.5.2 or later may address the issue if confirmed by the vendor. Until an official fix is available, restrict access to the OpenMed service and validate or sanitize user-supplied model_name parameters to prevent malicious input. Monitor vendor channels for updates.