Remote Code Execution With Modern AI/ML Formats and Libraries
Summary: Unit 42 found remote code execution vulnerabilities in three open-source AI/ML Python libraries published by Apple, Salesforce and NVIDIA, where loading a model file with malicious metadata executes embedded code. All three use the Hydra library's instantiate() function, which accepts any callable including builtins.exec(), and the affected libraries are used in HuggingFace models with tens of millions of downloads combined; no malicious examples had been found in the wild as of December 2025.
What's compelling: NVIDIA's NeMo format covers over 700 HuggingFace models and the flaw appears to have existed since at least 2020, while Hydra's block-list fix is not yet in a release as of January 2026 - so loading a downloaded model file can still mean running someone else's code.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026