Threats affecting pkg:github/myshell-ai/AIlice

A security vulnerability (CVE-2026-122160) exists in myshell-ai AIlice up to version 0.4.0 in the LoadModel_PEFT function of the HuggingFace Model Wrapper component. The vulnerability arises from improper handling of the base_model_name_or_path argument, allowing inclusion of functionality from an untrusted control sphere. The vulnerability can be exploited remotely and has been publicly disclosed. No patch or vendor response has been reported yet. The CVSS score is 6.3, indicating a medium severity.