Model and package supply chain

CosyVoice, through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21), has an insecure deserialization flaw (CWE-502) in its model loading component. The framework calls torch.load() on model weight files such as llm.pt, flow.pt and hift.pt without weights_only=True, so arbitrary Python objects can be deserialized through the pickle module. When a victim starts the CosyVoice Web UI pointing at a malicious model directory, arbitrary code runs on their system during model loading.

CosyVoice, through commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21), has an insecure deserialization flaw (CWE-502) in its gRPC server component. On startup, the server loads the speech synthesis model from a user-specified directory with torch.load() without weights_only=True, so pickle can deserialize arbitrary Python objects. An attacker who places malicious model files in a directory that a victim points the server to gains arbitrary code execution during server initialization.

CVE-2026-6859 affects InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace, so a remote attacker can achieve arbitrary Python code execution by persuading a user to run `ilab train/download/generate` with a crafted malicious model from the HuggingFace Hub. The weakness is classified as CWE-829, and NVD had not yet provided an assessment at publication.

onnx.hub.load() skips its trust check for untrusted model repositories when silent=True is passed, so no warning or confirmation prompt appears. The source states that the SHA256 check validates against a manifest that the attacker controls, so a malicious model can carry a matching hash. The source says that when chained with file-system vulnerabilities, a model loaded this way can silently exfiltrate files such as SSH keys and cloud credentials.

fickling versions up to and including 0.1.8 have an incomplete UNSAFE_IMPORTS blocklist that omits the stdlib modules uuid, _osx_support and _aix_support. Functions in these modules, such as uuid._get_command_stdout, _aix_support._read_cmd_output and _osx_support._find_build_tool, call subprocess.Popen() or os.system() with attacker-controlled arguments. A malicious pickle importing them passes fickling's UnsafeImports and NonStandardImports checks, and pickle.loads() runs the command.

CVE-2026-1669 is an arbitrary file read flaw in the model loading mechanism (HDF5 integration) of Keras versions 3.0.0 through 3.13.1 on all supported platforms. A remote attacker can use a crafted .keras model file with HDF5 external dataset references to read local files and disclose sensitive information. Google Inc. rated it CVSS 4.0 7.1 (High), with network attack vector, no privileges required, and user interaction required.

CVE-2024-14021 affects LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6. The unsafe deserialization flaw sits in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py, which calls pickle.load() on multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who supplies a crafted persist directory containing a malicious pickle file can achieve arbitrary code execution when a victim loads the index from disk. VulnCheck rates it CVSS 4.0 8.4 (High); NVD has not yet provided an assessment.

CVE-2025-14921 is a remote code execution flaw in the Transformer-XL model handling of Hugging Face Transformers. The flaw sits in the parsing of model files, where user-supplied data is not properly validated, leading to deserialization of untrusted data. A remote attacker can execute code in the context of the current user, provided the target visits a malicious page or opens a malicious file.

CVE-2025-14920 is a remote code execution flaw in the Perceiver model of Hugging Face Transformers, caused by deserialization of untrusted data during parsing of model files. A remote attacker can run arbitrary code in the context of the current user, but only if the target visits a malicious page or opens a malicious file.

CVE-2024-11394 is a remote code execution flaw in Hugging Face Transformers' handling of Trax model files. The component fails to validate user-supplied data, leading to deserialization of untrusted data. An attacker can run code in the context of the current user if the target visits a malicious page or opens a malicious file.

CVE-2024-11393 is a remote code execution flaw in the MaskFormer model of Hugging Face Transformers. The flaw sits in the parsing of model files, where user-supplied data is not properly validated, leading to deserialization of untrusted data. A remote attacker can run arbitrary code in the context of the current user, but only if the target visits a malicious page or opens a malicious file.

CVE-2024-5998 affects the FAISS.deserialize_from_bytes function in langchain-ai/langchain, which allows pickle deserialization of untrusted data. The issue affects the latest version of the product, and it can lead to the execution of arbitrary commands via the os.system function. The weakness is classified as CWE-502, Deserialization of Untrusted Data.