ACVE-2026-0311

In the wild

demonstrated · vendor

Artifact

Payload

pickle-rce · load-time-deserialisation

Platform status

huggingface · removed (checked 2026-09-20)

C2

—

Target

model loader

File hashes

• None recorded.

Description

What

Hugging Face exposes file-level security verdicts, including an unsafe level for Pickle-bearing files. This ACVE-native record captures the combination in which a loader proceeds after the Hub has identified that unsafe condition. The advisory does not label every flagged file malicious; it records a policy failure at the point where the warning is ignored.

Which configuration is exposed

A model is exposed when its lock contains at least one Hub file with level unsafe and the active loader is willing to execute Pickle or companion code. The combination is more precise than a name-only model warning because it requires both platform evidence and an unsafe loading policy.

How ACVE detects it

ACVE inspects models[].hubStatus.filesWithIssues[] for level unsafe. The nested matcher scopes the file issue to the same model object as the loader policy, avoiding a false combination across unrelated models. Missing status or loader policy is unknown and produces a possible result rather than a clean result.

Fix

Stop loading the flagged file, remove its cache blob, and rebuild from a reviewed artifact. Set loaderPolicy.weightsOnly to true where supported, prefer safetensors, and keep companion scripts disabled. Treat a clean scan as time-bounded evidence rather than a substitute for revision and hash pinning.

Grounding needed

A live Hub security-status check should confirm the recorded scanner field for the local artifact. The rule is a controlled configuration demonstration; it does not assert that every unsafe verdict has been exploited in the wild.

This record is limited to the condition named in the public source: Loading a Hub-flagged unsafe file bypasses the loader safety boundary. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  some filesWithIssues where
    level eq "unsafe"

Fix

Do not load a file marked unsafe and enforce a weights-only loader policy.

• Reconfigure loaderPolicy.weightsOnly to true. Avoid executable Pickle loading.
• Remove ~/.cache/huggingface/hub/models--*/blobs/**.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

REPORT

• https://huggingface.co/docs/hub/security-pickle
• https://huggingface.co/docs/hub/security-malware