{"action":"Upgrade winml-cli to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"winml-cli","cve_ids":["CVE-2026-84452"],"ecosystem":"PyPI","epss":0.01608,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-96p9-rh4f-92cf","id":"tcs_01M5KH8RBC65F29XMJV54ABPVR","modified_at":"2026-09-10T12:15:13.712070116Z","published_at":"2026-09-10T09:45:01.161894Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3944","https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf","https://nvd.nist.gov/vuln/detail/CVE-2026-84452","https://github.com/microsoft/winml-cli/pull/1321","https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993","https://github.com/microsoft/winml-cli","https://pypi.org/project/winml-cli","https://github.com/advisories/GHSA-96p9-rh4f-92cf"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-3944","url":"https://osv.dev/vulnerability/PYSEC-2026-3944"}],"summary":"Windows ML CLI: CORS misconfig enables localhost RCE"}