Full Breakdown
Vulnerabilities in AI Python Libraries Expose Hugging Face Models to Remote Code Execution
1/14/2026, 10:57:33 AM
Overview of the Vulnerabilities
Recent vulnerabilities identified in popular AI and machine learning (ML) Python libraries—NeMo, Uni2TS, and FlexTok—pose significant security risks for models hosted on Hugging Face, a platform that facilitates the sharing of machine learning models. These libraries, developed by Nvidia, Salesforce, and Apple in collaboration with the Swiss Federal Institute of Technology's Visual Intelligence and Learning Lab (EPFL VILAB), utilize the Hydra library for configuration management. The vulnerabilities stem from Hydra's `instantiate()` function, which can inadvertently allow remote code execution (RCE) when malicious metadata is loaded.
Technical Details of the Vulnerabilities
The `instantiate()` function in Hydra is designed to load configurations from model metadata. However, it can also accept any callable, which attackers can exploit to execute arbitrary code using built-in Python functions such as `eval()` and `os.system()`. Palo Alto Networks' Unit 42 discovered these flaws and reported them to the respective maintainers, who have since issued security warnings and fixes, including Common Vulnerabilities and Exposures (CVEs). Notably, Nvidia issued CVE-2025-23304 for NeMo, while Salesforce issued CVE-2026-22584 for Uni2TS.
Specific Library Vulnerabilities
- NeMo: Developed by Nvidia, NeMo allows for the creation of models using `.nemo` and `.qnemo` file extensions. The vulnerability arises because metadata is not sanitized before API calls to `hydra.utils.instantiate()`, enabling attackers to load maliciously crafted `.nemo` files.
- Uni2TS: Created by Salesforce, this library is used for time series analysis and works exclusively with `.safetensors` files. Similar to NeMo, Uni2TS uses `hydra.utils.instantiate()` to decode configurations, making it susceptible to the same vulnerabilities.
- FlexTok: Developed by Apple and EPFL VILAB, FlexTok processes images and also relies on `.safetensors` files. It has implemented fixes by using YAML for configuration parsing and establishing an allow list for classes that can invoke `instantiate()`.
Official Responses and Remediation Efforts
Salesforce confirmed that they proactively addressed the vulnerabilities in July 2025, asserting that there is no evidence of unauthorized access to customer data. Apple and EPFL VILAB have also implemented security measures, including documentation updates advising users to only load models from trusted sources.
Criticism and Concerns
Despite these remediation efforts, experts express concern over the potential for exploitation. Curtis Carmony, a malware research engineer at Unit 42, highlighted the ease with which attackers could modify existing models to include malicious metadata. The lack of immediate in-the-wild exploitation does not mitigate the risk, as the attack surface remains extensive.
Conclusion
The vulnerabilities in NeMo, Uni2TS, and FlexTok libraries underscore the critical need for robust security measures in AI and ML frameworks. As Hugging Face continues to host a vast array of models, the implications of these vulnerabilities could have far-reaching consequences if not adequately addressed. The ongoing updates and vigilance from library maintainers will be essential in safeguarding the integrity of machine learning applications.
