CVE-2026-71281

Name of the Vulnerable Software and Affected Versions Hugging Face peft (affected versions not specified)

Description The LoRA-GA and CorDA initialization modules call the torch.load() function on cache or covariance files specified in the configuration without setting the weights only=True parameter. This bypasses the safe-loading wrapper implemented in other parts of the codebase. Since torch.load() without weights only=True performs full pickle deserialization, an attacker can achieve arbitrary code execution by providing a malicious cache or covariance file, such as one that is shared or downloaded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.