A security vulnerability, identified as CVE-2026-124588, has been discovered in Hugging Face's finetrainers version 0.1.0 and 0.2.0. The issue arises in the Model Index Handler's resolve_component_cls function within the finetrainers/utils/model.py file. An attacker can inject code by manipulating the Library argument, allowing for remote code execution. A publicly available exploit exists, and the project has not yet responded to the issue report. This vulnerability matters to those building or operating AI agents using finetrainers, as it may be exploited by attackers, potentially compromising system security and integrity.