PyPI/winml-cli CVE-2026-84452: unknown, EPSS 1.61%

Windows ML CLI: CORS misconfig enables localhost RCE

Action: Upgrade winml-cli to 0.4.0 or later.

pip install winml-cli==0.4.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3944
• https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf
• https://nvd.nist.gov/vuln/detail/CVE-2026-84452
• https://github.com/microsoft/winml-cli/pull/1321
• https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993
• https://github.com/microsoft/winml-cli
• https://pypi.org/project/winml-cli
• https://github.com/advisories/GHSA-96p9-rh4f-92cf

CVE-2026-84452 · published 2026-09-10T09:45:01.161894Z · modified 2026-09-10T12:15:13.712070116Z · JSON