Remote Code Execution With Modern AI/ML Formats and Libraries

We identified remote code execution vulnerabilities in three open-source AI/ML Python libraries published by Apple, Salesforce and NVIDIA on their GitHub repositories. The affected libraries are NeMo, Uni2TS and ml-flextok, with Uni2TS used by Salesforce Morai and ml-flextok developed by Apple and EPFL VILAB; these libraries can execute arbitrary code through model metadata when loaded by Hydra’s instantiate() flow.

As of December 2025, Palo Alto Networks reported no malicious examples in the wild, and fixes were issued or mitigations implemented: NVIDIA issued CVE-2025-23304 and a fix in NeMo 2.3.2, Salesforce issued CVE-2026-22584 and deployed a fix on 31 July 2025, while the Uni2TS workflow relies on an allow list and validation to constrain execution.

The report notes that Hydra has been updated to warn about possible RCE and to add a block-list mechanism, though as of January 2026 this mechanism is not yet in a Hydra release, and the researchers state the approach is not exhaustive. These issues were disclosed after Palo Alto Networks notified the vendors in April 2025, according to Hydra documentation.