Threats affecting pkg:pypi/finetrainers

CVE-2026-124588 is a code injection vulnerability in huggingface finetrainers versions 0.1.0 and 0.2.0. The flaw exists in the resolve_component_cls function within finetrainers/utils/model.py, specifically in the Model Index Handler component. An attacker can remotely manipulate the Library argument to inject code. Public exploit code is available, but the vendor has not yet responded or issued a patch.