Is the Security section on Github tracked?

[kingroryg]

Could someone please take a look at the security finding reported via GIthub's Security section? It's been 2 weeks without an acknowledgment. Please let me know if I need to use a different process.

Thanx!

[dogukanveziroglu]

Vulnerability is not about mlx framework, its about mlx-lm.

[kingroryg]

Let's chat on the advisory if possible. It exists in core.

[dogukanveziroglu]

Saw your report and put up a fix: ml-explore/mlx-lm#1385. It gates the model_file exec behind trust_remote_code (CVE-2026-5843), on the mlx-lm side rather than core.

[kingroryg]

The PR fixes the Python wrapper but not a underlying issue in core. The heap overflow still exists.

[dogukanveziroglu]

When you said vulnerability I thought you refered the (CVE-2026-5843). I think I understand the problem on heap overflow but they are pretty understaffed so it might take a while to fix the issue.

[zcbenz]

Sorry no one was tracking it, I will take a look but there is a large backlog and there are probably many duplicates.