Model and package supply chain

CVE-2026-100308 affects the model loading component in Amazon GluonTS before 0.17.0. Deserialization of untrusted data may allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process, via a crafted serialized model directory.

The mlflow.statsmodels flavor's _load_model calls statsmodels.iolib.api.load_pickle, which wraps pickle.load, without checking MLFLOW_ALLOW_PICKLE_DESERIALIZATION. An attacker who can place a crafted MLmodel artifact with a malicious model.pkl in an accessible artifact store can trigger code execution in any process calling mlflow.pyfunc.load_model() on it, even when the setting is False. Default deployments without basic-auth require no credentials to upload the artifact.

MONAI's algo_from_pickle() in monai/auto3dseg/utils.py still calls pickle.loads() on attacker-supplied files in v1.5.2, despite GHSA-89gg-p5r5-q6r4 claiming the issue was patched. The source reports that the file was last changed on 2024-07-12, that all three pickle.loads() calls remain unchanged in v1.5.1 and v1.5.2, and that the advisory's referenced patch is a Zip Slip fix. Any application passing an attacker-controlled path to this function can achieve code execution.

CVE-2026-12484 affects keras-team/keras version 3.15.0. The public keras.layers.TorchModuleWrapper.from_config method calls torch.load(..., weights_only=False) without requiring an explicit unsafe opt-in, so it deserializes attacker-controlled PyTorch pickle data by default when no SafeModeScope(True) context is active. Processing untrusted Keras layer configurations this way can lead to arbitrary code execution.

BabelDOC's vendored PDF parser deserializes untrusted pickle data when loading CMap files, in `babeldoc/pdfminer/cmapdb.py`. A PDF-controlled CMap name is passed to `os.path.join()` and `pickle.loads()` after only NUL bytes are stripped, so a hex-encoded absolute path in a crafted PDF's `/Encoding` name can redirect deserialization to an attacker-writable `.pickle.gz` file, giving arbitrary Python code execution with the privileges of the BabelDOC process.

CVE-2026-54499 affects Stanza, the Stanford NLP Python library, before version 1.12.2. Model loaders such as stanza.models.common.pretrain.Pretrain.load() call torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) when a pickle.UnpicklingError is raised. An attacker-controlled malicious .pt pretrain or model file can therefore execute arbitrary pickle code when a Stanza NLP pipeline loads it.

CVE-2025-71372 affects Picklescan before 0.0.33. The scanner fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, so crafted pickle files that execute arbitrary Python code when loaded pass its safety checks. The flaw enables supply-chain poisoning of shared model files. VulnCheck rates it CVSS 4.0 7.6 (HIGH), and NVD has not yet provided an assessment.

CVE-2025-71342 affects picklescan before 0.0.30, which fails to detect malicious pickle files that use idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks. VulnCheck rates it CVSS 4.0 7.6 HIGH, and NIST has not yet provided an assessment.

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code that runs arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects.

An assert-based security check in vLLM's activation function loading, at vllm/model_executor/layers/pooler/activations.py:48, restricts which functions can be loaded from a HuggingFace model's config.json. When vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1), Python strips the assert, so an attacker-published malicious model can pass an arbitrary function_name to resolve_obj_by_qualname() and execute code during model initialization. The attack requires the victim to load the malicious model and the model to use a cross-encoder architecture.

A flaw in the LightGlue model loading path of huggingface/transformers 5.2.0 lets an attacker-controlled model repository run arbitrary code during model initialization. The `trust_remote_code` value, meant to block remote code, is overridden by the `trust_remote_code` setting read from the untrusted `config.json` and passed into nested `AutoConfig.from_pretrained()` calls. Code runs even when the victim calls `AutoModel.from_pretrained()` with `trust_remote_code=False`. The source rates the risk as high for inference servers, notebooks, CI/CD pipelines and evaluation workers, citing possible credential theft, lateral movement and persistence.

The mamba language model framework through 2.2.6 is affected by insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from_pretrained() method calls torch.load() on pytorch_model.bin without setting weights_only=True, so arbitrary Python objects can be deserialized via the pickle module. An attacker who publishes a malicious model repository can execute arbitrary code on a victim's system, in the context of the mamba process, when the victim loads a model from it.

CVE-2026-31232 affects the CosyVoice project through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) and is classified as CWE-502. The model loading process calls torch.load() without weights_only=True when reading .pt files from a directory passed via --model_dir, so arbitrary Python objects can be deserialized through Pickle. An attacker who supplies a crafted model directory can trigger remote code execution on a victim who loads it through the CosyVoice web interface.

The Adversarial Robustness Toolbox (ART) through 1.20.1 contains an insecure deserialization flaw (CWE-502) in its Kubeflow component's model loading. During robustness evaluation, model weights loaded from a file such as model.pt use torch.load() without weights_only=True, which permits Pickle deserialization of arbitrary Python objects. An attacker who uploads a crafted model file to object storage referenced by the pipeline, or who controls the model_id parameter to point to such a file, can achieve remote code execution when the pipeline loads the model.