Is iitolstykh/mivolo_v2 safe to load?
CyberXYZ rates iitolstykh/mivolo_v2 HIGH, driven by torch 2.5.1 · GHSA-53q9-r3pm-6pq6. It depends on 171 tracked packages, and 4 carry advisories. It ships Python that runs when the model is loaded (trust_remote_code).
HIGHDeclared install pins version-matched high/critical advisories: torch 2.5.1, transformers 4.51.0
10 more findings on this model.
- Author
- iitolstykh
- Loader
- mivolo
- License
- cc-by-nc-4.0
- Downloads
- 1,684,950
- Remote code
- ships Python that runs on load (trust_remote_code)
15 direct, 9 with findings, 163 reachable
| Package | Evidence | Advisories | Worst |
|---|---|---|---|
| torch | direct, install | 13 | CRITICAL |
| transformers | direct, install | 24 | HIGH |
- HIGHvector new2026-09-09
- HIGHrisk level raised (unknown to high)2026-09-09
Is iitolstykh/mivolo_v2 safe to load?
CyberXYZ does not call a model safe in absolute terms. It rates iitolstykh/mivolo_v2 HIGH, driven by torch 2.5.1 · GHSA-53q9-r3pm-6pq6. That covers its dependencies and how it loads, not every file it ships, so treat any check that did not run as unverified and check the exact files before you load them.
What does iitolstykh/mivolo_v2 depend on?
CyberXYZ tracks 171 dependencies for iitolstykh/mivolo_v2, 15 of them direct. 4 carry advisories. They include torch and transformers. A free account lists all of them.
Does iitolstykh/mivolo_v2 run code when it loads?
Yes, it can. iitolstykh/mivolo_v2 ships Python code and HuggingFace marks it trust_remote_code, so loading it with trust_remote_code enabled runs that code on your machine. Read the code first.
How do I check iitolstykh/mivolo_v2 before loading it?
Run the xyz MCP tool model_load_safety on iitolstykh/mivolo_v2 to get a verdict on its weight files before you load them, or search it in CyberXYZ Check at https://cyberxyz.io/check?q=iitolstykh%2Fmivolo_v2.
Risk computed 2026-11-14 at 11:48 UTC. Dependencies come from the model's requirements, its declared loader and the code it ships; advisories from NVD, GHSA and OSV.