---
title: "Security digest: February 27, 2024"
url: https://erroneo.us/security/2024-02-27/
description: "February 27, 2024 vulnerability digest: 1 brief (Malicious Hugging Face Models: Pickle Code…); 2 critical advisories (Go, Maven). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2024-02-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 27, 2024

1 editorial brief and 2 critical advisories.

## Take stock

- Check exposure: Malicious Hugging Face Models: Pickle Code Execution . Teams and researchers that download PyTorch .bin/.pt/.pkl or Keras models from arbitrary Hugging Face accounts and load them with full pickle deserialization, especially on machines holding credentials.
- Go: 1 critical advisory ( github.com/edgelesssys/marblerun ). Check with govulncheck ./... .
- Maven: 1 critical advisory ( org.apache.james:james-server ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Malicious Hugging Face Models: Pickle Code Execution](https://erroneo.us/security/briefs/hugging-face-malicious-pickle-models/index.md): This is a standing risk, not a one-off bug: loading a pickle-based model from an untrusted repo is running that author's code, so check how your pipelines load third-party weights.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [GHSA-x5r5-2qrx-rqj8](https://erroneo.us/security/ghsa/GHSA-x5r5-2qrx-rqj8/index.md) Transparent TLS may not be applied to Marbles with certain manifest configurations — Go github.com/edgelesssys/marblerun < 1.4.1 → 1.4.1
- [CVE-2023-51518](https://erroneo.us/security/cve/CVE-2023-51518/index.md) Apache James server: Privilege escalation via JMX pre-authentication deserialization — Maven org.apache.james:james-server <= 3.7.4 → 3.7.5; Maven org.apache.james:james-server >= 3.8.0, < 3.8.1 → 3.8.1

---
Source page: https://erroneo.us/security/2024-02-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt