NeuralNLP-NeuralClassifier CVE-2025-13708

Exploitation requires the victim to load an attacker-controlled model checkpoint file through the prediction path that calls torch.load() without weights_only=True (i.e., any installation using torch<2.6.0 or the pre-patch code). The concrete prerequisite is deserializing an untrusted PyTorch checkpoint (pickle) file - there is no network service to attack. LIMITING FACTORS: mandatory user interaction (UI:R) - the victim must actively obtain and open/load the malicious file; the attack vector is local (AV:L), not remotely triggerable without that step; and it is blocked by upgrading to torch>=2.6.0 or applying the patched weights_only=True loading. Authentication is not required to craft the payload (PR:N), but delivery depends on social engineering or supply-chain trust in the model source.

This is a CWE-502 untrusted-data deserialization flaw in Tencent NeuralNLP-NeuralClassifier's _load_checkpoint/_get_classification_model path, which called torch.load() without weights_only=True, allowing arbitrary code execution via a malicious PyTorch checkpoint (pickle) file. The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: the vector is LOCAL and requires user interaction (loading/opening a malicious checkpoint), NOT a network-facing service - so despite the 'Remote Code Execution' label, this is not a remote unauthenticated network exploit. EPSS is low (0.51%, 42nd percentile) and the CVE is NOT in CISA KEV, with no public exploit code referenced beyond the ZDI advisory, so there is no public exploit identified at time of analysis. The practical risk is moderate and conditional: exploitation hinges entirely on a victim being tricked into loading an attacker-supplied model file, which is a realistic supply-chain/social-engineering vector for ML tooling but not mass-exploitable. Conflicting-signal note: the title and 'remote attackers' phrasing imply remote reach, but the CVSS vector is AV:L - the 'remote' aspect is only that the malicious file originates remotely; actual trigger is local file deserialization. The description's claim of code execution 'in the context of root' is not reflected by a CVSS scope change (S:U) and should be treated as a deployment-specific observation rather than a guaranteed privilege outcome.

An attacker crafts a malicious PyTorch checkpoint file embedding a pickle payload and distributes it as a pretrained NeuralNLP-NeuralClassifier model (e.g., via a model-sharing site, email, or compromised repo). When a victim loads it for prediction, the unsafe torch.load() call deserializes the payload and executes attacker code in the process context (claimed as root in the advisory). No public exploit code is identified at time of analysis, but pickle-based torch.load RCE is a well-understood, trivially reproducible technique.