CVE-2026-22584

Uni2TS model configuration permits code injection

Salesforce · Uni2TS

First documented disclosure · Review checkpoint

Summary

Model metadata can reach executable configuration handling when vulnerable Uni2TS loads a model.

Severity and exploitation evidence

High · numeric CVSS score not recorded. Severity source.

Exploitation not established: The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Hydra instantiation processes attacker-controlled model configuration.

Conditions required

Loading a crafted model with the affected library.

Potential impact

Code execution with the model-loading process’s authority.

Affected versions and configurations

Uni2TS through 1.2.0 on macOS, Windows and Linux, according to the CNA.

Fix and mitigation status

Unit 42 reports an allowlist/validation fix on July 31, 2025; a numbered fixed release was not established from the accessible sources.

Practical next steps

Verify the upstream fix is present before loading third-party models; isolate model-loading jobs.

Operating lesson

A safe weights format does not make the surrounding model loader safe.

Evidence and limits

January 9 CNA publication precedes January 13 technical coverage. The Salesforce help page did not expose substantive text; fix timing is attributed to Unit 42, not independently read from that page. The July 2025 remediation predates this rolling window; January 9 is the earliest public security disclosure date verified in this review, not the date the code was first fixed.

Sources