mamba: from_pretrained calls torch.load without weights_only, so a model repo executes code

CVSS 9.8CVE-2026-31239AI/ML frameworks & servingcurated

Impact

Through 2.2.6, MambaLMHeadModel.from_pretrained() loads pytorch_model.bin with torch.load() and no weights_only=True, so the pickle stream in a model checkpoint is deserialized into arbitrary Python objects. Publishing a malicious repository on the Hub, or substituting a checkpoint anywhere in an internal model registry, gets code execution in the mamba process the moment someone loads it. On a GPU fleet that process is a training or inference job with the device files open, cluster credentials in its environment and write access to shared storage, so one pulled model turns into a foothold on the node and a path into the next job's data. The upstream repository is the only vendor reference in the record; no fixed version is named.

Who can reach it

Anyone who can get a checkpoint in front of a victim: a public Hub repository, a typo-squatted name, or write access to an internal model store. The victim only has to load the model; no further interaction is needed.

What to do

No fixed version is stated in the record. Load mamba checkpoints only from sources you control, pin them by revision and verify digests, and where you can, load weights with torch.load(..., weights_only=True) or a safetensors conversion before handing them to from_pretrained. Run model-loading jobs with the minimum credentials and no write access to shared model stores, so a bad checkpoint cannot spread.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-31239 https://github.com/state-spaces/mamba

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.