The vulnerability resides in the LoRA‑GA and CorDA initialization modules of Hugging Face peft, where torch.load is called on cache or covariance files specified in the configuration without the weights_only=True argument. This omission bypasses the library’s safe-loading wrapper and allows full pickle deserialization, enabling an attacker who can supply a crafted cache or covariance file—such as one hosted on a shared network or embedded within a malicious model—to execute arbitrary code during model loading, effectively gaining the privileges of the running process. The flaw is a classic deserialization vulnerability (CWE‑502).

All installations of the Hugging Face peft library that include the LoRA‑GA and CorDA modules are affected; specific version details are not supplied, so any deployment using the current code base is at risk. The vulnerability is present wherever these modules are used to load model configuration files from local or remote locations.

The CVSS score of 8.8 signals high severity, and the EPSS score of 0.00329 denotes an extremely low but non‑zero probability of exploitation. The absence of a KEV listing does not diminish the potential impact; the flaw allows code execution simply by supplying a malicious cache or covariance file. The likely attack vector is the loading of a privileged file during model initialization, inferred from the description that a shared or downloaded LoRA‑GA or CorDA cache could be used. An attacker with the ability to provide such a file—either by hosting it on a shared network or by compromising the file system—can trigger the flaw, compromising confidentiality, integrity, and availability of the affected system.