The mamba language model framework through version 2.2.6 is vulnerable to insecure deserialization (CWE-502) during the loading of pre-trained models from HuggingFace Hub. Specifically, the MambaLMHeadModel.from_pretrained() method uses torch.load() to load the pytorch_model.bin weight file without enabling the weights_only=True parameter, which restricts deserialization to tensor weights only. This omission allows deserialization of arbitrary Python objects via pickle, potentially leading to arbitrary code execution if a malicious model repository is loaded by a victim.

An attacker can publish a malicious model repository on HuggingFace Hub. When a victim loads this model using the vulnerable mamba framework method, arbitrary code can execute in the context of the mamba process on the victim's system. This can lead to full compromise of the affected system depending on the privileges of the mamba process. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid loading pre-trained models from untrusted or unknown sources on HuggingFace Hub. Monitoring official mamba framework channels for updates and applying any future patches promptly is recommended.