{"action":"Upgrade winml-cli to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"winml-cli","cve_ids":["CVE-2026-84452"],"ecosystem":"PyPI","epss":0.01608,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-96p9-rh4f-92cf","id":"tcs_01M5KF9ZXZR4VHYHJADSZXK8FJ","modified_at":"2026-09-10T12:25:25.044897858Z","published_at":"2026-09-08T21:27:59Z","references":["https://osv.dev/vulnerability/GHSA-96p9-rh4f-92cf","https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf","https://nvd.nist.gov/vuln/detail/CVE-2026-84452","https://github.com/microsoft/winml-cli/pull/1321","https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993","https://github.com/microsoft/winml-cli"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-96p9-rh4f-92cf","url":"https://osv.dev/vulnerability/GHSA-96p9-rh4f-92cf"}],"summary":"Windows ML CLI: CORS misconfig enables localhost RCE"}