Python libraries used in top AI and ML tools hacked - Nvidia, Salesforce and other libraries all at risk

News
By published

The bugs have been fixed, so users should patch now

A profile of a human brain against a digital background.
Image credit: geralt on Pixabay (Image credit: Pixabay)
  • Palo Alto found critical flaws in AI/ML libraries NeMo, Uni2TS, and FlexTok
  • Vulnerabilities allowed arbitrary code execution via malicious model metadata
  • All patched by mid-2025; no exploitation observed as of December 2025

Security researchers from Palo Alto Networks have discovered vulnerabilities used in some top Artificial Intelligence (AI) and machine Learning (ML) tools which, if abused, could allow threat actors to execute malicious code on target endpoints, remotely.

In a security advisory, the researchers said that around April 2025, they discovered bugs in three open source Python libraries published by Apple, Salesforce, and NVIDIA, on their GitHub repositories.

The libraries are called NeMo, Uni2TS, and FlexTok. NeMo is a PyTorch-based framework for research, Uni2TS a PyTorch library for research used by Salesforce’s Morai, and FlexTok is a Python-based framework for research, enabling AL and ML models to process images. Cumulatively, they have more than 10 million downloads on HuggingFace (a platform that hosts open-source AI models and other tools).

Bugs fixed

“The vulnerabilities stem from libraries using metadata to configure complex models and pipelines, where a shared third-party library instantiates classes using this metadata,” Palo Alto explained in its advisory.

“Vulnerable versions of these libraries simply execute the provided data as code. This allows an attacker to embed arbitrary code in model metadata, which would automatically execute when vulnerable libraries load these modified models.”

All three developers were notified in April 2025, and by the end of July, all were fixed. NVIDIA issued CVE-2025-23304 and gave it a high severity rating (7.8/10) and released a fix in NeMo 2.3.2. FlexTok updated its code in June 2025, while Salesforce issued CVE-2026-22584, gave it a critical rating (9.8/10), and fixed it in July 2025.

Palo Alto says that as of December 2025, there is no evidence that these vulnerabilities are being abused in the wild. All of the bugs were discovered by the company’s Prisma AIRS tool.

Best antivirus software header
The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

TOPICS
Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.