Skip to content
OpenAdvisories

Product · Hugging Face

peft

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-71281

    peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules

    Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft…

    Hugging Face peft