A security vulnerability (CVE-2026-124588) was discovered in Hugging Face's Finetruners versions 0.1.0 and 0.2.0. The issue arises from a code injection vulnerability in the `resolve_component_cls` function within `finetrainers/utils/model.py`. An attacker can exploit this flaw by manipulating the `Library` argument, which can be done remotely. This allows for potential attacks. The vulnerability has been publicly disclosed and a possible exploit has been released.