Hugging Face PyTorch Image Models Library Vulnerable to Remote Code Execution
A critical deserialization vulnerability in Hugging Face's PyTorch Image Models library allows remote attackers to execute arbitrary code by tricking users into opening malicious files or visiting crafted web pages.
A significant remote code execution (RCE) vulnerability has been identified within the Hugging Face PyTorch Image Models library, a popular toolkit for machine learning image tasks. The vulnerability, detailed by the Zero Day Initiative (ZDI) and assigned advisory number ZDI-26-523, stems from improper handling of checkpoint deserialization.
Attackers can exploit this flaw by enticing a user to interact with a malicious element, such as visiting a compromised webpage or opening a specially crafted file. This user interaction is the key to triggering the vulnerability, which lies in the library's failure to adequately validate data during the parsing of model checkpoints. The lack of robust input validation allows for the deserialization of untrusted data, leading to a security compromise.
Successful exploitation of this vulnerability grants attackers the ability to execute arbitrary code on the affected system. The code would run with the same privileges as the process handling the checkpoint, potentially allowing for significant system compromise depending on the user's permissions. The vulnerability carries a CVSS score of 7.8, indicating a high severity.
The issue has been addressed by the developers with the release of version 1.0.26 of the PyTorch Image Models library. Patches and code changes are available on the project's GitHub repository, specifically referencing pull request #2679. Users are strongly advised to update to the latest version to mitigate the risk.
The vulnerability was reported to the vendor on February 5, 2026, and the coordinated public release of the advisory occurred on July 30, 2026. The advisory was also updated on the same day. The discovery and reporting of this vulnerability are credited to Michael DePlante, associated with TrendAI and the Zero Day Initiative.
This vulnerability highlights the ongoing risks associated with deserialization flaws in software libraries, particularly those used in complex ecosystems like machine learning. As models and their associated data formats become more sophisticated, the potential attack surface expands, necessitating rigorous security practices throughout the development lifecycle.
While the vulnerability requires user interaction, its presence in a widely used library means that a broad range of applications and services relying on Hugging Face's PyTorch Image Models could be at risk if not promptly updated. The ease with which attackers can craft malicious files or webpages makes this a plausible threat vector.
Organizations utilizing the PyTorch Image Models library should prioritize updating to version 1.0.26 or later. For those unable to update immediately, reviewing security configurations and implementing additional monitoring for suspicious file handling or network activity related to checkpoint loading may offer some level of mitigation.