CVE-2026-31228 Details

A remote code execution vulnerability has been identified in the Adversarial Robustness Toolbox (ART) versions through 1.20.1, specifically within its Kubeflow component. The issue arises because the robustness evaluation function for PyTorch models improperly uses the eval() function to execute user-provided strings for the LossFn and Optimizer parameters, without any form of sanitization or security measures. This vulnerability allows an attacker to inject arbitrary Python code, which will be executed when eval() is invoked, potentially leading to a complete compromise of the system running the ART evaluation.