Vulnerabilities in AI/ML Libraries Enable Remote Code Execution via Malicious Metadata
Security researchers at Palo Alto Networks discovered vulnerabilities in three open-source AI/ML libraries from NVIDIA, Salesforce, and Apple that allow remote code execution through malicious metadata embedded in model files. All three vendors issued patches between June and July 2025, and as of December 2025, no active exploitation of these vulnerabilities has been observed.
What happened
Palo Alto Networks identified vulnerabilities in three open-source AI/ML Python libraries: NeMo (NVIDIA), Uni2TS (Salesforce), and FlexTok (Apple/Swiss Federal Institute of Technology). Vulnerable versions of these libraries allow remote code execution when a model file with malicious metadata is loaded, as the libraries execute metadata as code without proper validation.
Reported impact
The affected libraries are used in popular models on HuggingFace with tens of millions of downloads in total. As of December 2025, no malicious examples using these vulnerabilities have been found in the wild.
Index analysis
The vulnerabilities stem from libraries using metadata to configure complex models and pipelines, where a shared third-party library instantiates classes using this metadata. An attacker could embed arbitrary code in model metadata, which would automatically execute when vulnerable libraries load these modified models.
Governance controls
Palo Alto Networks notified all affected vendors in April 2025 to ensure time for implementing mitigations. NVIDIA issued CVE-2025-23304 (High severity) and released a fix in NeMo version 2.3.2, researchers updated FlexTok code in June 2025, and Salesforce issued CVE-2026-22584 (High severity) with a fix deployed on July 31, 2025.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.