9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31239

CVE-2026-31239: mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from_pretrained() method uses torch.load() to load the pytorch_model.bin weight file without enabling the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the pickle module. An attacker can exploit this by publishing a malicious model repository on HuggingFace Hub. When a victim loads a model from this repository, arbitrary code is executed on the victim's system in the context of the mamba process.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31239

CVE-2026-31239:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mamba-ssm	pip	<= 2.2.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the mamba-ssm package, specifically in how it loads pre-trained models. The MambaLMHeadModel.from_pretrained method, which is used to load these models, internally calls the load_state_dict_hf function. This function uses torch.load to deserialize the model file but fails to set the weights_only=True parameter. This omission allows an attacker to create a malicious model file containing arbitrary code. When a user loads this malicious model, the code is executed on their system, leading to a remote code execution vulnerability. The analysis of the source code of the vulnerable version confirms this flaw. No patch is available in the analyzed version, and the recommended mitigation is to manually enable the weights_only=True parameter or use a safer model loading method.

Vulnerable functions

MambaLMHeadModel.from_pretrained

mamba_ssm/models/mixer_seq_simple.py

The `from_pretrained` method in the `MambaLMHeadModel` class is used to load pre-trained models. This method calls the `load_state_dict_hf` function, which in turn uses `torch.load` to load the model weights. The vulnerability exists because `torch.load` is called without the `weights_only=True` parameter. This allows an attacker to craft a malicious model file that, when loaded, can execute arbitrary code on the victim's system.

load_state_dict_hf

mamba_ssm/utils/hf.py

This function is responsible for loading the model's state dictionary from a file. It uses `torch.load` to deserialize the model file, but it fails to use the `weights_only=True` parameter, which is a security measure to prevent the execution of arbitrary code. This function is called by `MambaLMHeadModel.from_pretrained`, making it a key part of the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.