{"data":{"ecosystem":"pypi","name":"mamba-ssm","url":"https://aisecwatch.com/packages/pypi/mamba-ssm","latestVersion":"2.3.2.post1","firstReleaseAt":"2023-12-04T19:35:23.998Z","repository":"https://github.com/state-spaces/mamba","llm":{"exposure":"direct","depth":0,"integratedAt":"2026-01-12T17:07:22.152Z","integratedVersion":"2.3.0","sdks":["huggingface"],"path":[]},"authority":{"profile":[],"fromDependencies":[]},"dependencies":[{"ecosystem":"pypi","name":"transformers","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"apache-tvm-ffi","versionSpec":"<=0.1.9","scope":"runtime"},{"ecosystem":"pypi","name":"causal-conv1d","versionSpec":">=1.2.0","scope":"extra:causal-conv1d"},{"ecosystem":"pypi","name":"einops","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"ninja","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"packaging","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"pytest","versionSpec":null,"scope":"extra:dev"},{"ecosystem":"pypi","name":"quack-kernels","versionSpec":">=0.3.4","scope":"runtime"},{"ecosystem":"pypi","name":"setuptools","versionSpec":">=61.0.0","scope":"runtime"},{"ecosystem":"pypi","name":"tilelang","versionSpec":"==0.1.8","scope":"runtime"},{"ecosystem":"pypi","name":"torch","versionSpec":null,"scope":"runtime"},{"ecosystem":"pypi","name":"triton","versionSpec":">=3.5.0","scope":"runtime"}],"advisories":[{"id":"52768d17-18f0-46f2-b554-02fa0695a700","url":"https://aisecwatch.com/issues/52768d17-18f0-46f2-b554-02fa0695a700","cveId":"CVE-2026-31239","title":"CVE-2026-31239: The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading…","headline":"mamba language model framework insecure deserialization when loading models","severity":"high","publishedAt":"2026-05-12T18:16:52.320Z","affected":["mamba-ssm@<= 2.2.6"],"epssScore":0.00597,"matchedBy":"ecosystem"}],"checkedAt":"2026-10-09T23:10:55.036Z"},"meta":{"advisoryMatching":"by package name and ecosystem; an advisory with no ecosystem recorded for the package is matched by name alone"}}