EUVD-2026-43277
GHSA-9wjg-4fhr-x4rw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only exploitation via file path argument control with low privilege; no scope change and symmetric low C/I/A impact confined to the training process.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.load of the file run_nerf.py of the component Checkpoint File Handler. The manipulation of the argument ckpt_path leads to deserialization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.
AnalysisAI
Unsafe deserialization in HashNeRF-pytorch's Checkpoint File Handler allows a local low-privileged attacker to achieve arbitrary code execution by supplying a malicious file via the ckpt_path argument to torch.load() in run_nerf.py. All commits up to 82885e698295982504eb6a26d060a6b2473e3706 are affected; a fix exists as an unmerged pull request (PR #50). A public exploit has been disclosed via GitHub issue #49, though no CISA KEV listing has been identified, indicating no confirmed widespread active exploitation at time of analysis.
Technical ContextAI
HashNeRF-pytorch is a PyTorch-based research implementation of hash-encoding Neural Radiance Fields (NeRF). The vulnerability resides in run_nerf.py within the Checkpoint File Handler, which invokes Python's torch.load() to restore model state from disk. By default, torch.load() relies on Python's pickle module for deserialization, a known dangerous pattern classified under CWE-502 (Deserialization of Untrusted Data). When no weights_only=True restriction is enforced, any serialized Python object - including one embedding malicious __reduce__ hooks - can execute arbitrary code at load time. The CPE cpe:2.3:a:yashbhalgat:hashnerf-pytorch:*:*:*:*:*:*:*:* covers all releases of the project, consistent with its rolling release model and lack of versioned tags.
RemediationAI
No officially merged patch exists at time of analysis; the fix is pending as pull request PR #50 (https://github.com/yashbhalgat/HashNeRF-pytorch/pull/50), which has not yet been accepted into the main branch. Users should monitor that PR and manually apply the patch to their local installations by cherry-picking the changes from PR #50. As an immediate compensating control, modify run_nerf.py to pass weights_only=True to torch.load(), which restricts deserialization to tensor primitives and prevents arbitrary Python object execution - note that this may cause failures if checkpoints store non-tensor metadata, requiring additional code changes to re-serialize those components safely. Additionally, enforce a policy of only loading checkpoint files from trusted, write-protected sources, and restrict file system write permissions on checkpoint directories to prevent untrusted users from substituting malicious files. Reference the VulDB advisory at https://vuldb.com/cve/CVE-2026-15531 for updates.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today