OpenMed Privacy-Filter Model Loader Remote Code Execution via Substring-Matched trust_remote_code

Unauthenticated model_name substring bypass routes to Hugging Face trust_remote_code=True loading, yielding arbitrary Python execution on the OpenMed PII service

OpenMed, an open-source local-first healthcare AI toolkit for clinical NER and HIPAA PII de-identification, is vulnerable to remote code execution in versions before 1.5.2. Its privacy-filter model loader used naive substring matching on the client-supplied model_name parameter and defaulted to trust_remote_code=True, so any Hugging Face repo name merely containing "privacy-filter" (e.g. attacker/foo-privacy-filter-bar) would be downloaded and its embedded Python code executed with the service's own privileges — no authentication required. Blast radius includes full host compromise and exposure of any PHI/PII the service processes. Fixed in OpenMed 1.5.2 via an explicit model allowlist.