{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0309",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Reused Hugging Face namespace can redirect a model to a successor owner",
  "details": "## What\n\nLegit Security documented the risk that an abandoned Hugging Face organization name can be registered again after the legitimate owner moves to a new namespace. The current API redirect from sberbank-ai to ai-forever is a platform state, not a cryptographic identity. A future ownership transfer or deletion can change what a name resolves to.\n\n## Which configuration is exposed\n\nThe exposed configuration resolves a model by the sberbank-ai namespace without a revision pin and accepts the Hub redirect or successor content. The issue is a trust-boundary failure in name resolution; it does not claim that the current ai-forever target is malicious or that this example caused a victim incident.\n\n## How ACVE detects it\n\nACVE records the namespace and requires a namespace creation time after the orphan date or a revision outside a reviewed allowlist. A missing namespaceCreatedAt is unknown and therefore possible. The lock must capture namespace metadata at enrichment time because a later API response cannot reconstruct the original owner history.\n\n## Fix\n\nPin the exact reviewed revision and record the file hashes used by the loader. Remove unpinned sberbank-ai cache entries, verify the redirect target independently, and prefer a maintained upstream namespace with ownership controls. Rebuild the lock after any Hub rename or redirect.\n\n## Grounding needed\n\nThe redirect and retirement behaviour should be rechecked against the Hub API and the published namespace-reuse analysis. This is a researcher demonstration of a supply-chain condition, not proof of victim execution.\n\nThis record is limited to the condition named in the public source: Reused Hugging Face namespace can redirect a model to a successor owner. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:sberbank-ai/*"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "hf:sberbank-ai/*"
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://www.legitsecurity.com/blog/tens-of-thousands-of-developers-were-potentially-impacted-by-the-hugging-face-aijacking-attack"
    },
    {
      "type": "REPORT",
      "url": "https://unit42.paloaltonetworks.com/model-namespace-reuse/"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "namespace-hijack"
      ],
      "cwe": [
        "CWE-502"
      ],
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.legitsecurity.com/blog/tens-of-thousands-of-developers-were-potentially-impacted-by-the-hugging-face-aijacking-attack",
            "type": "vendor",
            "note": "Legit Security demonstrated namespace reuse risk and the successor redirect."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "all": [
            {
              "field": "namespace",
              "op": "eq",
              "value": "sberbank-ai"
            },
            {
              "any": [
                {
                  "field": "namespaceCreatedAt",
                  "op": "gte",
                  "value": "2023-10-25T00:00:00Z"
                },
                {
                  "field": "revision",
                  "op": "notIn",
                  "value": []
                }
              ]
            }
          ]
        }
      },
      "fix": {
        "summary": "Pin a reviewed revision and avoid resolving abandoned namespaces by name.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "model.revision",
            "why": "A revision pin prevents a mutable namespace redirect."
          },
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--sberbank-ai--*/**"
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "namespace-hijack",
          "delivery": "config",
          "c2": [],
          "target": "model resolution"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "removed",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:27:40Z"
        },
        "fileHashes": [],
        "namespace": {
          "name": "sberbank-ai",
          "orphanedAt": "2023-10-24",
          "redirectTarget": "ai-forever"
        },
        "provenance": {
          "researcherCreated": true,
          "reporter": "Legit Security"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://www.legitsecurity.com/blog/tens-of-thousands-of-developers-were-potentially-impacted-by-the-hugging-face-aijacking-attack"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:27:40Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "removed",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:27:40Z"
          },
          "confirmed": []
        }
      }
    }
  }
}