CVE-2026-71281 in peft
Summary
by MITRE • 08/05/2026
Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load() on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase. Because torch.load() without weights_only=True performs full pickle deserialization, loading a malicious cache or covariance file (e.g. a shared/downloaded LoRA-GA or CorDA cache) results in arbitrary code execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability resides in the Hugging Face peft library's implementation of LoRA-GA and CorDA initialization modules where insecure loading practices create a critical arbitrary code execution vector. These modules specifically target the covariance and cache files used during parameter-efficient fine-tuning operations, with the problematic code executing at lines 102-103 and 163 in corda.py, along with line 101 in loraga.py. The core technical flaw occurs when torch.load() is invoked without the weights_only=True parameter, which fundamentally bypasses the library's own safe-loading mechanisms that are properly implemented elsewhere within the codebase. This deviation from established security patterns creates a direct path for malicious payload execution through pickle deserialization processes.
The operational impact of this vulnerability extends far beyond typical software flaws as it enables remote code execution through seemingly benign configuration files. Attackers can craft malicious covariance or cache files that, when loaded by unsuspecting users, trigger full pickle deserialization allowing arbitrary code to execute with the privileges of the running process. This represents a severe security risk in machine learning environments where model fine-tuning operations are common and users often download pre-trained components from shared repositories. The vulnerability affects any user who loads LoRA-GA or CorDA configurations from untrusted sources, making it particularly dangerous in collaborative or open-source ML workflows where trust assumptions may be misplaced.
Security implications of this issue align with CWE-502 which specifically addresses "Deserialization of Untrusted Data" and can be mapped to ATT&CK technique T1059.001 for command and scripting interpreter execution through pickle-based attacks. The vulnerability demonstrates a critical failure in the principle of least privilege and secure coding practices, where the library's own security wrappers are circumvented without proper validation or sanitization measures. This creates an attack surface that allows adversaries to escalate privileges and potentially compromise entire machine learning infrastructure, particularly when these tools are used in production environments with elevated permissions. The risk is amplified by the widespread adoption of these fine-tuning methods in both research and commercial applications.
Mitigation strategies should include immediate implementation of weights_only=True parameter enforcement in all torch.load() calls within the affected modules, followed by comprehensive code review to ensure no other instances of insecure loading exist. Additionally, the library should implement proper input validation and sanitization for all configuration files while establishing a more robust secure-loading framework that enforces consistent security practices across all components. Users should be advised to avoid loading configuration files from untrusted sources and to validate the integrity of any downloaded cache or covariance files through cryptographic means before use. The vulnerability also necessitates updating documentation to clearly warn about the risks associated with loading external parameter files and emphasizing the importance of verifying file origins in security-sensitive environments.