{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0311",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Loading a Hub-flagged unsafe file bypasses the loader safety boundary",
  "details": "## What\n\nHugging Face exposes file-level security verdicts, including an unsafe level for Pickle-bearing files. This ACVE-native record captures the combination in which a loader proceeds after the Hub has identified that unsafe condition. The advisory does not label every flagged file malicious; it records a policy failure at the point where the warning is ignored.\n\n## Which configuration is exposed\n\nA model is exposed when its lock contains at least one Hub file with level unsafe and the active loader is willing to execute Pickle or companion code. The combination is more precise than a name-only model warning because it requires both platform evidence and an unsafe loading policy.\n\n## How ACVE detects it\n\nACVE inspects models[].hubStatus.filesWithIssues[] for level unsafe. The nested matcher scopes the file issue to the same model object as the loader policy, avoiding a false combination across unrelated models. Missing status or loader policy is unknown and produces a possible result rather than a clean result.\n\n## Fix\n\nStop loading the flagged file, remove its cache blob, and rebuild from a reviewed artifact. Set loaderPolicy.weightsOnly to true where supported, prefer safetensors, and keep companion scripts disabled. Treat a clean scan as time-bounded evidence rather than a substitute for revision and hash pinning.\n\n## Grounding needed\n\nA live Hub security-status check should confirm the recorded scanner field for the local artifact. The rule is a controlled configuration demonstration; it does not assert that every unsafe verdict has been exploited in the wild.\n\nThis record is limited to the condition named in the public source: Loading a Hub-flagged unsafe file bypasses the loader safety boundary. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "hf:*"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "versions": [
        "hf:*"
      ]
    }
  ],
  "references": [
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-pickle"
    },
    {
      "type": "REPORT",
      "url": "https://huggingface.co/docs/hub/security-malware"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "artifact",
      "vulnClasses": [
        "over-privileged-combination"
      ],
      "cwe": [
        "CWE-502"
      ],
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://huggingface.co/docs/hub/security-pickle",
            "type": "vendor",
            "note": "The Hub documents per-file unsafe scanner verdicts and their limitations."
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "combination",
      "matcher": {
        "some": "models",
        "where": {
          "some": "filesWithIssues",
          "where": {
            "field": "level",
            "op": "eq",
            "value": "unsafe"
          }
        }
      },
      "fix": {
        "summary": "Do not load a file marked unsafe and enforce a weights-only loader policy.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "loaderPolicy.weightsOnly",
            "to": "true",
            "why": "Avoid executable Pickle loading."
          },
          {
            "type": "remove",
            "target": "~/.cache/huggingface/hub/models--*/blobs/**"
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "artifact": {
        "payload": {
          "class": "pickle-rce",
          "delivery": "load-time-deserialisation",
          "c2": [],
          "target": "model loader"
        },
        "platformStatus": {
          "platform": "huggingface",
          "status": "removed",
          "flaggedBy": [],
          "downloadable": false,
          "checkedAt": "2026-09-20T16:27:42Z"
        },
        "fileHashes": [],
        "provenance": {
          "researcherCreated": true,
          "reporter": "ACVE"
        }
      },
      "evidence": [
        {
          "kind": "incident",
          "url": "https://huggingface.co/docs/hub/security-pickle"
        }
      ],
      "grounding": {
        "artifact": {
          "checkedAt": "2026-09-20T16:27:42Z",
          "platformStatus": {
            "platform": "huggingface",
            "status": "removed",
            "flaggedBy": [],
            "downloadable": false,
            "checkedAt": "2026-09-20T16:27:42Z"
          },
          "confirmed": []
        }
      }
    }
  }
}