CVE-2026-79785

Name of the Vulnerable Software and Affected Versions X-AnyLabeling (affected versions not specified)

Description The model downloader disables TLS certificate verification by using ssl. create unverified context() within the download with retry() function in anylabeling/services/auto labeling/model.py. This allows an attacker to intercept HTTPS connections and provide malicious content. The safe check model() function only validates the file format and does not verify the file's provenance via hashes or signatures. For ONNX targets, an attacker can control the model used for inference. For .pth or .pt targets used by SAM2 video, YOLOE, UPN, and open vision configurations, the application calls torch.load() without the weights only parameter, which can lead to arbitrary code execution during the unpickling process on older PyTorch releases.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.