Mamba CVE-2026-31239

Exploitation requires the victim to explicitly call MambaLMHeadModel.from_pretrained() or equivalent model loading functions targeting an attacker-controlled or compromised HuggingFace Hub repository. The victim must have network connectivity to HuggingFace Hub or another model hosting service containing the malicious model. No special Mamba framework configuration or non-default features are required-the vulnerability exists in default model loading behavior. Limiting factors include: victim must make the conscious decision to download and load a specific external model (social engineering or supply chain compromise required); many organizations use private model registries or airgapped environments that prevent loading arbitrary HuggingFace models; security-conscious teams already implement model verification workflows that would detect anomalous pickle content; the attack leaves forensic artifacts in download history and model cache directories. The CVSS UI:N rating is misleading-while no interactive prompt blocks exploitation, the attack fundamentally depends on user action (model selection and loading), not automated scanning or wormable propagation.

CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicates maximum exploitability: network-accessible, low complexity, no authentication or user interaction required. However, this critically overstates real-world risk for this specific vulnerability. Exploitation requires the victim to explicitly load a model from an attacker-controlled or compromised HuggingFace repository-the attack is not against the Mamba library itself but against users who trust malicious model sources. The CVSS UI:N rating is arguably incorrect since a user must intentionally call from_pretrained() with a specific repository identifier. EPSS 0.02% (5th percentile) aligns with actual low exploitation likelihood, reflecting that attacks require social engineering to convince targets to load malicious models and that the ML community increasingly scrutinizes model provenance. Not present in CISA KEV, indicating no confirmed widespread exploitation. Real risk is moderate for organizations with poor supply chain hygiene around ML models, but low for environments with model verification processes. The vulnerability's impact is legitimately critical (full system compromise), but attack complexity is realistically medium-to-high despite CVSS rating, as it depends on trust exploitation rather than technical vulnerability exploitation alone.

An attacker creates a malicious Mamba model on HuggingFace Hub by crafting a pytorch_model.bin file containing a pickled Python object with a __reduce__ method that executes reverse shell code. The attacker publishes this model under a convincing name like 'mamba-sota-2026' and promotes it through ML forums or academic preprints. A researcher or developer, trusting the HuggingFace platform, runs victim_model = MambaLMHeadModel.from_pretrained('attacker/mamba-sota-2026') in their Jupyter notebook or production pipeline. During model loading, torch.load() deserializes the malicious pickle, triggering arbitrary code execution that establishes persistence, exfiltrates credentials from the development environment, and pivots to connected systems with the developer's privileges.