Linnet's promise is that loading a model runs no code from the model's author: the .linnet source is checked, and the backends' code is generated by the compiler. A model repository, card, bindings file, checkpoint or source file that breaks that promise is a vulnerability. So is one that makes the compiler or a loader read or write files outside the model, or corrupt memory.

Report it privately through a security advisory, not in a public issue. Include the input that triggers it and what it does. You will get a reply within a week, and a fix is released before the details are made public.

Fixes go to the latest release. A model that is merely large (memory, disk or time) is not a vulnerability in itself; Linnet does not sandbox the programs it runs.