What is the CVSS score of CVE-2026-31219?

CVE-2026-31219 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Optimate are affected by CVE-2026-31219?

CVE-2026-31219 affects Optimate's model loading functionality, exposing the organization to remote code execution through malicious PyTorch model files.

How to fix or mitigate CVE-2026-31219?

Within 24 hours: Inventory all Optimate deployments and identify systems processing external or untrusted PyTorch model files. Restrict command-line access to neural_magic_training.py and disable automated model loading from external sources. Within 7 days: Implement file validation controls and isolate affected systems from production networks; contact Optimate for patch timeline and workaround guidance. Within 30 days: Apply vendor-released patch immediately upon availability; conduct code review of all custom model loading scripts for similar deserialization patterns.

Optimate CVE-2026-31219

EUVD-2026-29503 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-05-12 mitre

GHSA-f5xg-pvfx-vwh9

Python RCE Deserialization N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:22 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

May 12, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable to insecure deserialization (CWE-502). When a user provides a single model file path (e.g., .pt or .pth) via the --model command-line argument, the function loads the file using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects through the Pickle module. A remote attacker can exploit this by providing a maliciously crafted model file, leading to arbitrary code execution during deserialization on the victim's system.

AnalysisAI

Insecure deserialization in Optimate's neural_magic_training.py script enables remote code execution when loading PyTorch model files. The _load_model() function uses torch.load() without the weights_only=True security parameter, allowing attackers with low privileges to execute arbitrary Python code by providing malicious .pt or .pth files via the --model command-line argument. EPSS indicates low exploitation probability at 0.06% with no active exploitation confirmed.

Technical ContextAI

The vulnerability exists in the neural_magic_training.py script of the Optimate project (commit a6d302f912b481c94370811af6b11402f51d377f). When loading PyTorch model files, the code uses torch.load() which internally relies on Python's Pickle module for deserialization. This is a classic CWE-502 insecure deserialization vulnerability where untrusted data is deserialized without proper validation. PyTorch introduced the weights_only=True parameter specifically to prevent arbitrary object deserialization, but the vulnerable code doesn't use this security feature.

RemediationAI

No vendor-released patch identified at time of analysis. Primary mitigation is to modify the _load_model() function to use torch.load() with the weights_only=True parameter, which prevents arbitrary object deserialization. As an immediate workaround, restrict access to the --model command-line argument to trusted users only, or implement input validation to ensure model files come from trusted sources. Organizations should audit model file sources and implement file integrity checks. Note that enabling weights_only=True may break compatibility with older model formats that contain non-tensor objects.