2vyper (0.3.0), black-mamba (>=0.1.0, <=0.5.2) +4 more potentially affected by CVE-2020-37287 via vyper (>=0.1.0b3, <=0.2.4)

vyper PYPI version =0.1.0b3, =0.1.0, =1.4.0, =0.1.3, =0.1.2b2, =0.1.2b4 Source cves: CVE-2020-37287 Source advisory: MEND:CVE-2020-37287...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.5.2) +4 more potentially affected by CVE-2020-37287 via vyper (>=0.1.0b3, <=0.2.4)

vyper PYPI version =0.1.0b3, =0.1.0, =1.4.0, =0.1.3, =0.1.2b2, =0.1.2b4 Source cves: CVE-2020-37287 Source advisory: OSV:GHSA-4V7V-GQF9-WW2G...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.4.2) +1 more potentially affected by unknown CVE via vyper (>=0.1.0b12, <=0.1.0b17)

vyper PYPI version =0.1.0b12, =0.1.0, =1.4.0, =1.7.1 Source cves: unknown CVE Source advisory: GHSA-VG88-3V92-RJX2...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.4.2) +1 more potentially affected by unknown CVE via vyper (>=0.1.0b12, <=0.1.0b17)

vyper PYPI version =0.1.0b12, =0.1.0, =1.4.0, =1.7.1 Source cves: unknown CVE Source advisory: SNYK:PYTHON-VYPER-21693750...

PT-2026-106324

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.31.1 Description A remote out-of-bounds read can occur within the Completions Request Handler component. The issue resides in the conv ssm forward function located in the vllm/model executor/layers/mamba/mamba mixer2.p...

mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

PYSEC-2026-406 mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

PT-2026-53489

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from pretrained method uses torch.load to load the pytorch model.bin weight file without enabling the security-restrictive...

CVE-2026-31239

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

Deserialization of Untrusted Data

Overview mamba-ssm is a Mamba state-space model Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the frompretrained process. An attacker can execute arbitrary code by publishing a malicious model repository on HuggingFace Hub and having a victim load a mode...

GHSA-PQ2F-X424-6FJM mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

EUVD-2026-29562

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

CVE-2026-31239

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

PT-2026-40126

Name of the Vulnerable Software and Affected Versions mamba versions prior to 2.2.7 Description Insecure deserialization occurs when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.from pretrained function uses torch.load to load the pytorch model.bin weight file without...

CVE-2026-31239

The mamba language model framework (versions through 2.2.6 ) is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from the HuggingFace Hub . The MambaLMHeadModel.from_pretrained() method utilizes torch.load() to process the pytorch_model.bin weight file without enab...

Mamba security vulnerabilities

Mamba is a state-space model for linear time series modeling, open-sourced by State-Spaces. Versions of Mamba 2.2.6 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the MambaLMHeadModel.frompretrained method, which used torch.load to load weight files without...

CVE-2026-31239: Deserialization of Untrusted Data

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

CVE-2026-31239

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...

CVE-2026-31239

The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...