Hugging Face Hub Privilege Escalation Vulnerability Allows Poisoning of Private Models
Overview
A privilege escalation vulnerability was discovered and patched in the Hugging Face Hub's repository access control system. The flaw allowed a user with read-only permissions on a private model repository to gain write access, enabling them to modify model files, including weights and source code. The vulnerability stemmed from an improper authorization check in an internal API endpoint responsible for managing repository uploads via Git LFS (Large File Storage). An attacker with 'read' access could craft a direct API request to this endpoint, bypassing the UI and primary Git server's permission checks, to initiate an LFS upload. This allowed the attacker to overwrite existing files or add new ones. The primary impact is a model supply chain attack. An attacker could use this to poison a popular private model used by many organizations. By subtly modifying the model weights (a backdoor attack) or embedding malicious code in a `pickle` file (`.pkl`) which is often used for serialization, the attacker could achieve remote code execution on the infrastructure of any downstream user who downloads and uses the compromised model. This vulnerability posed a significant threat to organizations relying on the Hugging Face Hub for secure and private model hosting. The Hugging Face team responded quickly, patching the vulnerability server-side.
Affected Systems
Testing Guide
1. The vulnerability was patched server-side and cannot be tested by users. 2. To test general model security hygiene: attempt to load a known malicious pickle file (e.g., from a security research repository) using a scanner like `picklescan` to verify that your security tools can detect it. 3. Regularly review audit logs for your Hugging Face organization to look for unexpected commits or changes to your private repositories.
Mitigation Steps
1. No user action is required as the vulnerability was patched on the Hugging Face platform side. 2. As a best practice, always verify the integrity of models downloaded from any source using checksums (hashes) if provided by the model author. 3. Scan downloaded model files, especially pickle files, for malicious code using tools like `picklescan` before loading them. 4. Run model inference and training in sandboxed, network-isolated environments to limit the potential impact of a compromised model.
Patch Details
The vulnerability was patched server-side by the Hugging Face security team on 2025-10-23.