Improper Locking Affecting airunner package, versions [,5.0.4)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-AIRUNNER-14829329
- published1 Jan 2026
- disclosed1 Jan 2026
- creditUnknown
Introduced: 1 Jan 2026
CVE NOT AVAILABLE CWE-667 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade airunner to version 5.0.4 or higher.
Overview
airunner is a Run local opensource AI models (Stable Diffusion, LLMs, TTS, STT, chatbots) in a lightweight Python GUI
Affected versions of this package are vulnerable to Improper Locking due to DarkLock network restrictions not being activated alongside the OS sandbox in the bundled facehuggershield integration. An attacker can leverage a malicious model or script that, while restricted from the local filesystem, maintains full access to the network.