EUVD-2026-29498
GHSA-qw5f-8jqw-9832
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains an insecure deserialization vulnerability (CWE-502). The script uses torch.load() to process PyTorch checkpoint files (.pt) without enabling the security-restrictive weights_only=True parameter. This oversight allows the deserialization of arbitrary Python objects via the pickle module. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, leading to arbitrary code execution in the context of the user running the script.
AnalysisAI
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to execute malicious Python code by providing crafted PyTorch checkpoint files. The vulnerability stems from insecure deserialization where torch.load() processes .pt files without the weights_only=True safeguard, enabling pickle-based arbitrary object instantiation. Despite a critical CVSS 9.8 score, EPSS probability is low (0.06%, 19th percentile) and no public exploit or active exploitation is confirmed, suggesting limited real-world targeting to date. SSVC assessment indicates total technical impact with automatable exploitation potential, making this a priority for organizations using ml-engineering scripts in production environments.
Technical ContextAI
This vulnerability exploits Python's pickle module, used by PyTorch's torch.load() function for serializing model checkpoints. Pickle can deserialize arbitrary Python objects, including those with __reduce__ methods that execute code during unpickling. The torch-checkpoint-shrink.py script at line 57 (commit 0099885db36a8f06556efe1faf552518852cb1e0) calls torch.load() without the weights_only=True parameter introduced in PyTorch 1.13+ to prevent arbitrary code execution. CWE-502 (Deserialization of Untrusted Data) occurs when applications deserialize data from untrusted sources without validation. In machine learning workflows, checkpoint files are often shared via repositories, cloud storage, or model hubs, creating multiple attack vectors. The CPE data is generic (n/a), indicating the vulnerability affects the ml-engineering GitHub repository scripts rather than a formally packaged product. The attack requires only that a victim process a malicious .pt file through this script, with no authentication barriers for file sourcing.
RemediationAI
Update the torch-checkpoint-shrink.py script by adding weights_only=True parameter to all torch.load() calls, specifically at line 57 where the vulnerability exists. Modify the code from torch.load(file_path) to torch.load(file_path, weights_only=True) to restrict deserialization to tensor data only. No formal patched release version exists as this is a script repository-users must manually apply the fix by editing their local copy or pulling updated commits if the maintainer has released a fix. As an immediate compensating control, implement input validation to process checkpoint files only from trusted, cryptographically verified sources such as signed model registries. Deploy the script in sandboxed execution environments (containers with no network access, restricted filesystem permissions, non-privileged user accounts) to limit blast radius of successful exploitation-note this reduces but does not eliminate risk as code execution still occurs within the sandbox context. For production ML pipelines, implement checkpoint integrity verification using cryptographic signatures before processing, and maintain an allowlist of approved checkpoint sources. Audit all PyTorch-using scripts for similar torch.load() calls without weights_only=True. Trade-off: weights_only=True may break compatibility with checkpoints containing custom objects or optimizer states-test thoroughly in development before production deployment.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today