CVE-2026-31239: mamba language model framework insecure deserialization when loading models

Summary

The mamba language model framework through 2.2.6 is affected by insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from_pretrained() method calls torch.load() on pytorch_model.bin without setting weights_only=True, so arbitrary Python objects can be deserialized via the pickle module. An attacker who publishes a malicious model repository can execute arbitrary code on a victim's system, in the context of the mamba process, when the victim loads a model from it.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mamba-ssmPyPILLM dependency since 2026-01-12 · 1 tracked dependent

Topics

• Model and package supply chain

Related items

• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database
• HighCVE-2026-58474: whichllm code injection in run and snippet commands via GGUF filenamesSame vendor · NVD/CVE Database
• HighCVE-2026-79784: Vocos class instantiation from configuration via from_pretrainedSame vendor · NVD/CVE Database