News, updates, trends and the latest
info you need to know about IT

Overview
A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library.
Description
Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in CVE‑2026‑80047, affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating user consent by resolve_trust_remote_code(). Although execution of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform trust_remote_code verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious custom_generate/generate.py file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt.
Impact
The vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code.
Solution
At the time of writing, no vendor-provided patch or advisory is available. Users should avoid invoking load_custom_generate() with untrusted model repositories and periodically inspect or clear the Hugging Face module cache (~/.cache/huggingface/modules) to remove unexpected content. Implementations should ensure that trust_remote_code checks occur prior to any remote content retrieval or local file writes.
Acknowledgements
Thank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer.

Overview
The Kaltura HTML5 Player V2 Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Notably, only versions of the legacy player (Player V2) are vulnerable; these issues do not affect any versions of the currently supported Kaltura Player V7.
Description
Kaltura is an AI video platform that provides tools for video management, publishing, playback, and integration with web applications. Kaltura’s HTML5 player library exposes the mwEmbedLoader.php endpoint, which accepts a user-controlled ServiceUrl parameter as the target URL for backend API requests. The KalturaClientBase PHP client library fetches data from this URL and automatically deserializes it using PHP’s unserialize() function without validating source, scheme, or content.
CVE-2026-19913 results from the combination of this unsafe deserialization flaw and improper error-handling behavior. An attacker can provide the location of a local file to ServiceUrl as a file:// path, and the client will fetch the internal file’s contents and attempt to deserialize them. When deserialization fails, the raw bytes are reflected back to the client in the resulting error message, enabling the attacker to read any file accessible to the web-server user.
CVE-2026-19912 is caused by insufficient sanitization of the parameter uiconf_id, which is appended to the base cache folder path when the application writes data to disk. Because this value is user-controlled and unsanitized, an attacker can supply values that include directory traversal sequences such as ../ to redirect file writes outside the intended cache directory. When the deployment uses the default file-based cache backend, an attacker can direct ServiceUrl to a malicious serialized object containing executable PHP code, then supply a uiconf_id path value that writes its deserialized fields to a web-accessible directory. The attacker can then request the file directly to achieve remote code execution as the web-server user. A memcache-only backend may suppress the file write and prevent this specific code-execution path, but the underlying unsafe deserialization behavior and unsanitized path construction remain present.
Impact
These vulnerabilities allow a remote, unauthenticated attacker to read arbitrary local files and execute arbitrary commands as the web-server user. No authentication or Kaltura session token is required to exploit either issue; an attacker only needs network access to the affected html5lib endpoint.
CVE-2026-19913 can be abused to obtain database credentials, administrative secrets, API keys, or any other sensitive information hosted on the affected instance. Remote code execution achieved through CVE-2026-19912 allows an attacker to modify or exfiltrate platform data, deploy tools for persistence and lateral movement, and further compromise affected Kaltura deployments. Because the affected endpoint is also exposed on Kaltura’s shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts.
Solution
Kaltura has released new patches to remediate these vulnerabilities in all affected legacy Player V2 versions. Customers using legacy players, including self-hosted legacy player deployments (html5lib v2.x), should update to the patched version or, preferably, migrate to the newer and currently supported Kaltura Player V7 platform. Until the update is applied, users are advised to restrict or disable access to the mwEmbedLoader.php endpoint.
Acknowledgements
Thanks to Gerjan Wemekamp (AndDone) for researching and reporting these vulnerabilities. This document was written by Molly Jaconski.

Overview
Konami’s Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members’ machines through specially crafted data.
Description
Metal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking to handle its multiplayer lobbies and matches. As detailed in CVE‑2026‑19874, version 1.1.2.8 of Metal Gear Online 3 (Steam AppID 287700) contains an input‑validation vulnerability in the processing of Steam lobby metadata related to the player‑removal feature. The game tracks a lobby field (kick_num) indicating the number of players designated for removal, along with corresponding Steam ID entries of each kicked player (kicked_id_%i). When joining a lobby, the player’s client parses these fields to check whether its own Steam ID is on the list, and if so, the player is prevented from joining the match.
The function responsible for parsing this lobby data does not validate the kick_num value against the size of the fixed‑length buffer allocated for kicked player identifiers. Supplying a kick_num value larger than the buffer capacity results in out‑of‑bounds writes into adjacent memory. The memory region immediately following this buffer contains internal Steamworks callback handler structures that store function pointers and callback arguments for processing lobby data changes, messages, and other related events. By manipulating the overflow, an attacker can corrupt these handler structures and redirect callback execution, resulting in control‑flow hijacking on affected client systems. The vulnerability can be triggered automatically when a client joins a lobby controlled by an attacker.
Impact
Exploitation of this vulnerability may allow remote code execution on affected clients. Initial control‑flow hijacking provides access only to existing in‑process code; however, the Metal Gear Online 3 binary includes Denuvo‑protected regions mapped with read‑write‑execute (RWX) permissions. These regions permit runtime injection of attacker‑supplied code, significantly increasing the severity of the issue. An attacker hosting a lobby can achieve code execution on any client that joins, without requiring further interaction from the victim. Additionally, because host privileges are automatically reassigned to another lobby participant when the current host exits, an attacker can obtain host control during an active match and subsequently deliver the malicious lobby data to all connected players. This enables compromise of multiple systems through a single exploitation event.
Solution
As of this writing, Konami has not released patch notes or an advisory that specifically addresses this vulnerability, but a fix was included in version 1.1.2.9 of the Metal Gear Online 3 executable, mgsvmgo.exe. The patch also iterated the server and lobby version numbers from 15 to 16 and 150 to 160, respectively, to prevent players on older versions from accessing the online services.
This is the latest patch that fixed the vulnerability:
https://steamdb.info/patchnotes/24176213/
The full patch list can be found here:
https://steamdb.info/app/287700/patchnotes/
Acknowledgements
Thank you to Alice Cecchetto for reporting this vulnerability. This document was written by Bob Kemerer.