What is the CVSS score of CVE-2026-71281?

CVE-2026-71281 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Hugging Face PEFT are affected by CVE-2026-71281?

Hugging Face PEFT versions with LoRA-GA and CorDA modules contain unsafe pickle deserialization vulnerabilities that enable arbitrary code execution when loading malicious cache files.

How to fix or mitigate CVE-2026-71281?

Within 24 hours, inventory all systems running Hugging Face PEFT and document which deployments actively use LoRA-GA or CorDA modules; restrict write access to all cache and covariance file directories to authenticated administrative accounts only. Within 7 days, deploy file integrity monitoring (FIM) on cache directories, isolate PEFT workloads to sandboxed or containerized environments with network egress restrictions, and audit all configured model repository sources to eliminate public or untrusted repositories. Within 30 days, establish a vendor communication channel with Hugging Face for patch availability tracking, evaluate parameter-efficient fine-tuning alternatives that do not rely on unsafe deserialization, and implement signed model artifact verification for cache file validation.

Hugging Face PEFT CVE-2026-71281

EUVD-2026-53366 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-05 TuranSec

GHSA-g7pc-47rc-wvwf

RCE Deserialization Hugging Face Peft

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network vector reflects shared/downloaded cache delivery; UI:R because victim must actively load the file; PR:N as no target-side authentication gates deserialization; full C/I/A impact from arbitrary code execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:44 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.8

DescriptionCVE.org

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load() on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase. Because torch.load() without weights_only=True performs full pickle deserialization, loading a malicious cache or covariance file (e.g. a shared/downloaded LoRA-GA or CorDA cache) results in arbitrary code execution.

AnalysisAI

Unsafe pickle deserialization in Hugging Face PEFT's LoRA-GA and CorDA initialization modules allows arbitrary code execution when a victim loads a malicious cache or covariance file. The affected code paths in corda.py (lines ~102 and ~163) and loraga.py (line ~101) call torch.load() without weights_only=True, bypassing the safe-loading wrapper that PEFT enforces elsewhere in the codebase. An attacker who can supply or substitute a pre-computed LoRA-GA or CorDA cache file - for example via a shared model repository or poisoned download - achieves full code execution in the victim's ML environment upon initialization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

PEFT (Parameter-Efficient Fine-Tuning) is a Hugging Face library enabling efficient adaptation of large language models via techniques such as LoRA. LoRA-GA and CorDA are initialization strategies that pre-compute covariance or cache matrices to accelerate or improve LoRA training; these matrices are saved and loaded as files specified by the user's configuration. PyTorch's torch.load() function performs full Python pickle deserialization by default, which is an inherently unsafe operation because pickle can instantiate arbitrary Python objects and execute code during deserialization. The weights_only=True flag, introduced in PyTorch to restrict deserialization to safe tensor types, is used in other parts of the PEFT codebase but was omitted in the three torch.load() call sites identified: corda.py at approximately lines 102 and 163, and loraga.py at approximately line 101. This is a CWE-502 (Deserialization of Untrusted Data) root cause. The affected CPE is cpe:2.3:a:huggingface:peft:*:*:*:*:*:*:*:*, indicating all tracked PEFT versions are potentially affected.

RemediationAI

No vendor-released patch version has been confirmed at time of analysis; references point only to the upstream repository and source file rather than a fix commit or tagged release. Users should immediately audit any use of LoRA-GA or CorDA initialization in their PEFT workflows and avoid loading cache or covariance files from untrusted or unverified sources. As a direct compensating control, developers can manually patch the three affected torch.load() call sites in corda.py (~lines 102 and 163) and loraga.py (~line 101) to add weights_only=True, consistent with PEFT's own safe-loading wrapper used elsewhere in the codebase - note this may break loading of legacy cache files that contain non-tensor objects, requiring those caches to be regenerated. Additionally, restrict the file paths accepted by the config to local, cryptographically verified files only, and avoid downloading pre-computed LoRA-GA or CorDA caches from public or untrusted repositories until a patch is released. Monitor https://github.com/huggingface/peft for upstream fix commits and new releases.