{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0310",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Takedown can leave malicious Hugging Face namespaces reusable",
  "details": "## What\n\nThe Open-OSS and anthfu namespaces used for the model lures were 404 at the research check after takedown. Unit 42 explains that deletion or transfer can leave an old namespace available for re-registration. A removed malicious owner therefore creates a second risk: a later attacker can publish new content under the name trusted by old configuration.\n\n## Which configuration is exposed\n\nThe exposed setup resolves either namespace by name and does not bind the model to a revision or content hash. The condition covers downstream mirrors and cache refreshes as well as direct Hub downloads. A 404 today is not evidence that a cached artifact is safe or that future name ownership will remain empty.\n\n## How ACVE detects it\n\nACVE checks model.namespace against Open-OSS or anthfu and compares namespaceCreatedAt with the documented orphan date. It also treats an unreviewed revision as a match. Missing creation metadata remains possible so a lock cannot convert an unknown ownership history into a clean result.\n\n## Fix\n\nDelete unpinned cache entries, pin a reviewed revision and file hashes, and block automatic refreshes from the affected namespaces. If a mirror is required, verify its digest independently and retain the old namespace in a denylist so a later re-registration cannot silently re-enter the pipeline.\n\n## Grounding needed\n\nThe current 404 state and the namespace-reuse mechanism need a live recheck. The record is ACVE-native and researcher-created; the evidence demonstrates the condition without establishing a separate victim campaign.\n\nThis record is limited to the condition named in the public source: Takedown can leave malicious Hugging Face namespaces reusable. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:Open-OSS/*"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "hf:Open-OSS/*"
      ]
    },
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:anthfu/*"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "hf:anthfu/*"
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://unit42.paloaltonetworks.com/model-namespace-reuse/"
    },
    {
      "type": "REPORT",
      "url": "https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "namespace-hijack"
      ],
      "cwe": [
        "CWE-502"
      ],
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://unit42.paloaltonetworks.com/model-namespace-reuse/",
            "type": "vendor",
            "note": "Unit 42 describes ownership deletion and transfer paths that can make a model namespace reusable."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "artifact",
      "matcher": {
        "some": "models",
        "where": {
          "all": [
            {
              "any": [
                {
                  "field": "namespace",
                  "op": "eq",
                  "value": "Open-OSS"
                },
                {
                  "field": "namespace",
                  "op": "eq",
                  "value": "anthfu"
                }
              ]
            },
            {
              "any": [
                {
                  "field": "namespaceCreatedAt",
                  "op": "gte",
                  "value": "2026-05-09T00:00:00Z"
                },
                {
                  "field": "revision",
                  "op": "notIn",
                  "value": []
                }
              ]
            }
          ]
        }
      },
      "fix": {
        "summary": "Pin revisions and refuse model resolution from a deleted namespace.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "model.revision",
            "why": "Use immutable content identity."
          },
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--Open-OSS--*/**"
          },
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--anthfu--*/**"
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "namespace-hijack",
          "delivery": "config",
          "c2": [],
          "target": "model resolution"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "removed",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:27:41Z"
        },
        "fileHashes": [],
        "namespace": {
          "name": "Open-OSS",
          "orphanedAt": "2026-05-08"
        },
        "provenance": {
          "researcherCreated": true,
          "reporter": "Unit 42"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://unit42.paloaltonetworks.com/model-namespace-reuse/"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:27:41Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "removed",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:27:41Z"
          },
          "confirmed": []
        }
      }
    }
  }
}