CVE-2026-15679

Name of the Vulnerable Software and Affected Versions Hugging Face PyTorch Image Models (affected versions not specified)

Description Remote attackers can execute arbitrary code on affected installations due to improper validation of user-supplied data during the parsing of checkpoints. This leads to the deserialization of untrusted data, allowing code execution within the context of the current process. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.