Skip to content
OpenAdvisories
High MSRC-CVE-2026-23654 1 CVE

GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability

Published Mar 10, 2026 · Updated Mar 10, 2026

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could exploit this issue by publishing a malicious package named “geneformer” to the public PyPI registry using the same name referenced in the project’s requirements file. If a user installs the affected open‑source project and the installation process retrieves this malicious package instead of an intended legitimate one, the attacker’s code could run on the user’s system during installation. This could allow the attacker to execute unauthorized code.

Security updates
0.1.1 — https://github.com/microsoft/zero-shot-scfoundation/releases/tag/v0.1.1

Vulnerabilities 1

  • High 8.8
    CVE-2026-23654

    GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability

    Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network.

    Microsoft GitHub Repo: Zero Shot scFoundation

Revision history

  1. #1

    Information published.

References