New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks

By: Newsroom — February 27^th 2024 at 10:18

Cybersecurity researchers have found that it's possible to compromise the Hugging Face Safetensors conversion service to ultimately hijack the models submitted by users and result in supply chain attacks. "It's possible to send malicious pull requests with attacker-controlled data from the Hugging Face service to any repository on the platform, as well as hijack any models that are submitted

The Hacker News

Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch

By: Newsroom — October 3^rd 2023 at 16:24

Cybersecurity researchers have disclosed multiple critical security flaws in the TorchServe tool for serving and scaling PyTorch models that could be chained to achieve remote code execution on affected systems. Israel-based runtime application security company Oligo, which made the discovery, has coined the vulnerabilities ShellTorch. "These vulnerabilities [...] can lead to a full chain Remote

Naked Security