What it is
Four sub-cases, kept apart because the controls differ: deserialization of executable formats, template evaluation in a data path, references inside an artifact that the reader follows, and resource abuse through a parser.
Safety of a parser is often a property of a transitive dependency's version, which the reviewed project does not reveal.
Variants and records
Operator postmortem
An autonomous AI agent, running a security evaluation, got in through two inputs a data pipeline trusted. An HDF5 file that said its data lived at a path on the host disclosed files, including secrets. A template expression hidden in a data field ran code in a worker pod. It then escalated to cluster admin (see INF09).
Hugging Face postmortem. Intrusion 9 to 13 July 2026, technical timeline published 27 July. One incident crossing several categories.
Deserialization
Some services turn network bytes back into objects with a format (pickle) that can run code while decoding. If an attacker can reach the service, crafted bytes run their code.
vLLM PyNcclPipe, CVE-2025-47277. The Mooncake integration, CVE-2025-32444 and CVE-2025-29783 (fixed in vLLM 0.8.5 and 0.8.0). LMCache cache transport, CVE-2026-105192 (fixed in 0.5.6, which rejects legacy pickle).
Forged shared-memory handle
vLLM passes large multimodal data between its own processes through shared memory, referred to by a handle. A caller who can forge a handle makes a worker decode attacker-chosen bytes, which runs code. It works even with insecure serialization switched off.
vLLM CVE-2026-115912, 2026-10-20. Needs the shm cache setting and an authenticated caller. Affected up to 0.25.1, patched in 0.32.0.
Media decoder to interpreter
An uploaded image labeled PNG can really be another format, such as EPS. The image library hands that to the Ghostscript program on the host, and a vulnerable Ghostscript runs attacker commands.
vLLM CVE-2026-115915, 2026-10-20. Loader-level execution reproduced; the HTTP path was only traced in source; needs a vulnerable host Ghostscript.
One rule. Prefer formats that cannot execute, sandbox the rest, and parse untrusted artifacts in a process with no credentials and no network.
Check your stack
Tests
Each test has a positive control: a condition under which it must fail. A test that cannot fail proves nothing. These are procedures. Hedgerow has not run them.
Executable format
- Do
- Load a benign artifact whose load action writes a marker file.
- Pass
- Refused, no marker.
- Must fail when
- The permissive loader is enabled.
Template probe
- Do
- Put a harmless arithmetic expression in a templated field.
- Pass
- Sandbox error or literal text, not 49.
- Must fail when
- The sandbox is off.
Embedded reference
- Do
- Open a file whose internal reference points at a canary path.
- Pass
- The reference is refused.
- Must fail when
- A loader that follows references.
Mapping to AISVS, ATLAS and CWE
| Framework | Mapping |
|---|---|
| OWASP AISVS 1.01 | Good fit: 4.1.2 (explicit allowlist of serialization formats that cannot execute code on load), 6.1.1 (models scanned before import), 3.1.3 (signatures verified on load) and 6.1.3 (third-party artifacts integrity-verifiable). Request-time media decoding is not covered. |
| MITRE ATLAS 5.6.0 | AML.T0011.000 Unsafe AI Artifacts, and AML.T0010 AI Supply Chain Compromise for the delivery route. |
| CWE | CWE-502 Deserialization of Untrusted Data, as assigned in the deserialization and shared-memory advisories. CWE-20 Improper Input Validation, as assigned in the media decoder advisory. |
Controls
- Prefer formats without executable constructs.
- Remove template evaluation from configuration parsing, or sandbox it and pin the version that does so.
- Validate artifact-internal references, not just API arguments.
- Parse untrusted artifacts in a process with no credentials and no network.
What this page does not claim
- The tests have not been run by Hedgerow.
- Standards mappings reflect the versions named and may change as they do.
- A cited record shows the mechanism occurred in at least one implementation. It does not say any given system is affected.