CVE-2026-31239: The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-train

The mamba language model framework (versions up to 2.2.6) has a vulnerability in how it loads pre-trained models from HuggingFace Hub (a platform where AI models are shared). When loading models, it uses an unsafe method called torch.load() without the weights_only=True security parameter, which allows attackers to sneak malicious code into model files. An attacker could upload a compromised model to HuggingFace Hub, and when someone downloads and loads it, the attacker's code runs on their computer.