pickle deserialization
Safeguard articles tagged "pickle deserialization" — guides, analysis, and best practices for software supply chain and application security.
3 articles
LMCache CVE-2026-105192: Securing vLLM's KV Cache Server After 0.5.6
LMCache CVE-2026-105192: one ZeroMQ message ran code via pickle. 0.5.6 fixes it, but example manifests and images lag. Safe setup steps and a checker.
CVE-2026-25874: Unauthenticated RCE in Hugging Face's LeRobot
A critical, unauthenticated remote code execution flaw in Hugging Face's LeRobot robotics library stems from pickle deserialization over an unencrypted gRPC channel — putting arbitrary code execution directly on a robotics control plane.
nullifAI: How Two Malicious Models Slipped Past Hugging Face's Scanner
ReversingLabs found two Hugging Face models that hid a reverse-shell payload from Picklescan by compressing pickle files with 7z instead of ZIP. Here's how the trick worked and why pickle-format models remain a code-execution risk.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.