CVE-2026-71281

A flaw was found in peft. The LoRA-GA and CorDA initialization modules within Hugging Face peft improperly call torch.load without the weightsonly=True parameter. This oversight allows for full pickle deserialization when loading a malicious cache or covariance file. A remote attacker could explo...