Peft
Monthly
Unsafe pickle deserialization in Hugging Face PEFT's LoRA-GA and CorDA initialization modules allows arbitrary code execution when a victim loads a malicious cache or covariance file. The affected code paths in corda.py (lines ~102 and ~163) and loraga.py (line ~101) call torch.load() without weights_only=True, bypassing the safe-loading wrapper that PEFT enforces elsewhere in the codebase. An attacker who can supply or substitute a pre-computed LoRA-GA or CorDA cache file - for example via a shared model repository or poisoned download - achieves full code execution in the victim's ML environment upon initialization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unsafe pickle deserialization in Hugging Face PEFT's LoRA-GA and CorDA initialization modules allows arbitrary code execution when a victim loads a malicious cache or covariance file. The affected code paths in corda.py (lines ~102 and ~163) and loraga.py (line ~101) call torch.load() without weights_only=True, bypassing the safe-loading wrapper that PEFT enforces elsewhere in the codebase. An attacker who can supply or substitute a pre-computed LoRA-GA or CorDA cache file - for example via a shared model repository or poisoned download - achieves full code execution in the victim's ML environment upon initialization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.