https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:24:24.174351+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-71281 CVE-2026-71281 — peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules 2026-10-07T07:24:24.188794+00:00

Affected: huggingface peft

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase.