Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.

Axolotl versions through 0.18.0 contain a critical remote code execution vulnerability in the multipack patch path. The vulnerability arises because the trust_remote_code parameter defaults to None instead of False, allowing the security guard to be bypassed. During the multipack patching process, AutoModelForCausalLM.from_pretrained is called with a hardcoded trust_remote_code=True, enabling arbitrary Python code execution. An attacker can exploit this by crafting a malicious Hugging Face model repository and designating it as the base_model in an Axolotl configuration. This effectively allows remote attackers to execute arbitrary code on systems using Axolotl for model fine-tuning. A fix has been committed and a pull request addressing the issue is available in the official repository.