Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in the mamba framework allows attackers to run arbitrary code on your systems by publishing a malicious model on HuggingFace Hub. When the framework loads this model, it can execute harmful commands, potentially compromising your environment.
- Arbitrary code execution is possible.
- Affects systems loading models from HuggingFace.
- The issue involves insecure loading of model weights.
Attack Path
How an attacker could exploit the issue
An attacker can weaponize this by publishing a malicious pre-trained model on HuggingFace Hub. When a user loads this model using the `mamba` framework, their system will execute arbitrary Python code included in the model's weights file. This allows the attacker to gain control over the victim's machine in the context of the user's `mamba` process.
- Attacker publishes malicious model.
- User loads model with `mamba` library.
- Arbitrary code execution occurs.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could be attractive to attackers due to its critical severity and potential for remote code execution. However, its exploitation depends on users loading a malicious model, which is less common than exploiting public-facing services.
- Requires user to load a malicious model.
- No observed exploitation.
- Published recently with no exploit code.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize investigating and containing any instance where the Mamba language model framework is used to load models from HuggingFace Hub, as this vulnerability allows for arbitrary code execution. Teams should focus on identifying where `MambaLMHeadModel.from_pretrained()` is called without the `weights_only=True` parameter and block any suspicious model downloads.
- Block untrusted model downloads.
- Isolate or disable affected Mamba services.
- Audit Mamba configurations for `weights_only=True`.
