What happened
Published Sept 2, 2026 (CVSS 8.6), this flaw combines a classic localhost-CORS-misconfiguration pattern with an unauthenticated command API to allow drive-by RCE against developers running the WinML CLI's local server.
Why it matters
As Windows ML CLI becomes a standard tool for packaging AI models for Windows deployment, an unauthenticated localhost API reachable from any browser tab significantly expands the attack surface for ML developer workstations — a pattern seen repeatedly across AI dev tooling (Ollama, UFO framework) this quarter.
Attack vector
The WinML CLI exposes its command API via an unauthenticated localhost HTTP server with an overly permissive allow_origins CORS setting. An attacker can lure a victim to a malicious webpage while the local API is running; the page's JavaScript can issue cross-origin requests to the localhost API to execute WinML CLI commands, achieving code execution on the developer's machine.
Affected systems
Microsoft Windows ML CLI prior to 0.4.0 (src/winml/modelkit/serve/cli_api.py)
Mitigation
Upgrade to Windows ML CLI 0.4.0 or later, which adds authentication and restricts CORS origins.