[Triage] Markdown ignore (PYSEC-2026-89) reasons only about the audited Python env, while the one reachable markdown consumer is the docker-compose TensorBoard image (tensorflow/tensorflow… (CR-A16-116) #827

Needs triage. Reviewers disagreed on this finding, so it is not counted in the backlog. Decide whether it is a real defect: if yes, set severity and wave; if not, close it with the reason.

CR-A16-116 — Markdown ignore (PYSEC-2026-89) reasons only about the audited Python env, while the one reachable markdown consumer is the docker-compose TensorBoard image (tensorflow/tensorflow:2.15.0), fed TC-U H…

severity Low · confidence disputed · single reviewer · reproduced (plumbing only)

What happens. The entry concedes the DoS is 'genuinely remote' and justifies suppression with 'Installed markdown 3.10.2 is post-fix' (tools/pip_audit_ignores.yaml:157-162). That holds for the env the nightly audits: the project venv has markdown 3.10.2 and the extras, latest and lower venvs have 3.11. But forgelm/ never imports markdown. In the dependency stack the only importer is tensorboard/plugin_util.py:23, the TensorBoard server's text-plugin renderer (text_plugin.py:174-185 -> markdown_to_safe_html), and TC-U text reaches it by default. report_to defaults to 'tensorboard' (forgelm/config.py:604-605), forgelm/trainer.py:519 passes it to TrainingArguments, and transformers' TensorBoardCallback.on_train_begin writes add_text('model_config', model.config.to_json_string()) (integration_utils.py:627-632). The model config comes from the Hub repo's config.json (IN-07, TC-U), and unknown keys survive to_json_string. The project ships the renderer as its own docker-compose service: image: tensorflow/tensorflow:2.15.0, logdir ./output, --host=0.0.0.0, port 6006 published (docker-compose.yaml:50-61). The nightly pip-audit audits only the runner's pip install -e .[security] env (.github/workflows/nightly.yml:294-327), so the markdown that actually renders attacker-influenced text is outside both the gate and this entry's reasoning. Whether that image's markdown falls in CVE-2025-69534's affected range could not be established offline (see research questions). This is not a gate fail-open: the gate would not see the image with or without the ignore.

Failure scenario. An operator fine-tunes a Hub model whose config.json carries a malformed HTML-like string, then opens the shipped TensorBoard service. If the image's markdown is in the affected range, the text plugin's parse raises AssertionError on that summary: the text tab fails (DoS of the dashboard request), and the service listens on 0.0.0.0:6006. Impact is availability of a monitoring UI only.

Where.

• tools/pip_audit_ignores.yaml:153-168
• docker-compose.yaml:50-60
• forgelm/config.py:604-605
• forgelm/trainer.py:519
• .github/workflows/nightly.yml:294-327

Evidence.

• Dynamic, extras venv: a crafted key ('attacker_note': '<![ crafted <!x-- payload') added to a copy of env/tiny-qwen/config.json survives AutoConfig.from_pretrained(...).to_json_string(). tensorboard.plugin_util.markdown_to_safe_html renders it (markdown 3.11, no crash, 855 chars). Library lines, extras venv: transformers/integrations/integration_utils.py:627-632 (add_text args / model_config), :647 (add_text for string log values); tensorboard/plugins/text/text_plugin.py:174-185; tensorboard/pl…

Recommended fix. Scope the entry's claim to 'the nightly-audited env', and either audit or bump the compose TensorBoard image: pin a tensorboard image or pip-install tensorboard plus markdown>=3.8.1 in it. Optionally bind the service to 127.0.0.1. Re-verify the version claim (installed is now 3.10.2 or 3.11).

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}