CVE-2026-15679: Hugging Face PyTorch Image Models (timm) RCE — Detection and Remediation

---
title: Potential Python Deserialization Exploit - Shell Spawning
id: 9a1b2c3d-4e5f-6789-0123-456789abcdef0
status: experimental
description: Detects Python or PyTorch processes spawning shell environments (bash/sh), a common post-exploitation step for pickle deserialization attacks.
references:\  - https://zerodayinitiative.com/advisories/ZDI-26-523/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/python'
      - '/python3'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  filter_legit_dev:
    CommandLine|contains:
      - 'pytest'
      - 'virtualenv'
      - 'conda'
  condition: selection and not filter_legit_dev
falsepositives:
  - Legitimate developer testing scripts (rare in production nodes)
level: high
---
title: Python Spawning PowerShell or Cmd on Windows
id: b2c3d4e5-6789-0123-4567-89abcdef012
status: experimental
description: Detects Python processes spawning cmd.exe or powershell.exe, indicative of code execution exploits on Windows ML workstations.
references:
  - https://zerodayinitiative.com/advisories/ZDI-26-523/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentProcessName|endswith:
      - '\python.exe'
      - '\pythonw.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - System administration scripts
level: high
---
title: Python Spawning Network Utility (Reverse Shell Pattern)
id: c3d4e5f6-7890-1234-5678-9abcdef01234
status: experimental
description: Detects Python spawning netcat, curl, or wget commonly used in reverse shells following a successful RCE.
references:
  - https://zerodayinitiative.com/advisories/ZDI-26-523/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/python'
      - '/python3'
    Image|endswith:
      - '/nc'
      - '/netcat'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Legitimate data download scripts (verify command line)
level: critical


**KQL (Microsoft Sentinel / Defender)**

// Hunt for Python processes spawning suspicious child processes (Linux/Windows)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("python", "python3", "python.exe")
| where FileName in ("bash", "sh", "powershell.exe", "cmd.exe", "nc", "netcat", "curl", "wget")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for Python processes spawning shells or network tools
SELECT Parent.Pid as ParentPid, Parent.Name as ParentName, Parent.Cmdline as ParentCmd,
       Pid, Name, Cmdline, Username
FROM pslist()
LEFT JOIN pslist() AS Parent ON Parent.Pid = Ppid
WHERE Parent.Name =~ "python"
  AND (Name =~ "(bash|sh|zsh|nc|curl|wget|powershell|cmd)$")


**Remediation Script (Bash)**

#!/bin/bash
# Remediation script for CVE-2026-15679
# Forces upgrade of timm and PyTorch to latest secure versions

echo "[+] Checking for vulnerable timm installation..."

# Check if timm is installed
if pip show timm > /dev/null 2>&1; then
    echo "[!] timm found. Upgrading to latest version to mitigate CVE-2026-15679..."
    pip install --upgrade timm
    if [ $? -eq 0 ]; then
        echo "[+] Upgrade successful."
    else
        echo "[-] Upgrade failed. Please run manually: pip install --upgrade timm"
        exit 1
    fi
else
    echo "[?] timm is not installed in this environment."
fi

# Ensure PyTorch is also up to date as it is the underlying serialization engine
echo "[+] Checking PyTorch version..."
pip install --upgrade torch

echo "[+] Remediation check complete."