CVE-2026-31228

Name of the Vulnerable Software and Affected Versions Adversarial Robustness Toolbox versions prior to 1.20.2

Description A flaw exists in the Kubeflow component of the Adversarial Robustness Toolbox. The robustness evaluation function for PyTorch models utilizes the eval() function to dynamically process user-supplied strings for the LossFn and Optimizer parameters without proper sanitization. A remote attacker can exploit this by providing a specially crafted string containing arbitrary Python code, resulting in remote code execution and complete compromise of the system running the evaluation.

Recommendations Update to version 1.20.2 or later. As a temporary mitigation, avoid providing unsanitized user input to the LossFn and Optimizer parameters within the Kubeflow component.