george0papasotiriou/cve-2026-23001-hugging-face-transformers-model-deserialization-arbitrary-code-via-pickle-Proof-of-concept for CVE-2026-23001: demonstrates RCE through unsafe pickle deserialization in Hugging Face Transformers by crafting a malicious model that executes code when loaded with torch.load().
Hugging Face models saved with torch.save() use Python’s pickle serialization, which is inherently unsafe. If a user downloads a seemingly legitimate model from a repository, loading it can trigger arbitrary code execution, compromising the entire environment.
torch.load() does not sandbox the pickle deserialization; attackers can inject a __reduce__ method that executes shell commands.pip install torch
python malicious_model_card.py
python exploit_hf_pickle.py
The file /tmp/hf_pwned appears, proving code execution.