CVE-2026-115924: Python Unvalidated Model Name In Unpinned Downloadcve-2026-115924-python-unvalidated-model-name-in-unpinned-download
A model/asset name read from caller-supplied $KWARGS is interpolated into a downloaded asset's URL/filename and fetched with no integrity check (hash argument is None). A crafted name can carry path-traversal ("../") and URL-fragment ("#") syntax that steers the local write path and the fetched URL independently, letting an unauthenticated caller plant attac
