CVE-2026-31239

{
  "id": "CVE-2026-31239",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T18:16:52.320",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from_pretrained() method uses torch.load() to load the pytorch_model.bin weight file without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by publishing a malicious model repository on HuggingFace Hub. When a victim loads a model from this repository, arbitrary code is executed on the victim's system in the context of the mamba process."
    },
    {
      "lang": "es",
      "value": "El framework del modelo de lenguaje mamba hasta la versión 2.2.6 es vulnerable a deserialización insegura (CWE-502) al cargar modelos preentrenados desde HuggingFace Hub. El método MambaLMHeadModel.from_pretrained() utiliza torch.load() para cargar el archivo de pesos pytorch_model.bin sin habilitar el parámetro restrictivo de seguridad weights_only=True. Esto permite la deserialización de objetos Python arbitrarios a través del módulo pickle. Un atacante puede explotar esto publicando un repositorio de modelos malicioso en HuggingFace Hub. Cuando una víctima carga un modelo desde este repositorio, se ejecuta código arbitrario en el sistema de la víctima en el contexto del proceso mamba."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T16:52:22.756950Z",
          "id": "CVE-2026-31239",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/state-spaces/mamba",
      "source": "[email protected]"
    },
    {
      "url": "https://www.notion.so/CVE-2026-31239-35d1e1393188810d9baedfbd8363f396",
      "source": "[email protected]"
    }
  ]
}