Security brief

AI model metadata enabled code execution in three Python library workflows

REVIEW

Unit 42’s research covered NeMo, Uni2TS and FlexTok, demonstrating why model-loading safety extends beyond tensor formats.

Published 29 Oct 2026 · Material update 13 Jan 2026 — last time the underlying evidence changed · Evidence: high

What happened

Unit 42 disclosed model-loading vulnerabilities in NeMo, Uni2TS and FlexTok. Malicious metadata could cause vulnerable library workflows to instantiate unintended code, even when the model’s underlying format appeared safer than a conventional executable artifact.

The researchers reported fixes in NeMo 2.3.2, a June 2025 FlexTok code update and a July 31, 2025 Uni2TS fix. The associated identifiers include CVE-2025-23304 and CVE-2026-22584.

Unit 42 said it had found no malicious examples exploiting these issues as of December 2025. Check the specific library and loading path, apply its fix and isolate processing of untrusted models. Download counts are not evidence that every model or user was compromised.

Read the original source.

Next step

Update the relevant library and isolate loading of untrusted model artifacts.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2025-23304
CVE
CVE-2026-22584