EUVD-2026-33701
GHSA-84q4-pj7g-82qq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.
AnalysisAI
Arbitrary code execution in ESA AnomalyMatch before 1.3.1 allows local attackers with low privileges to run code under the application's process by planting a malicious PyTorch checkpoint into a session directory, which is loaded via torch.load() with weights_only=False. No public exploit is identified at time of analysis, but the upstream fix (PR #9) and a third-party advisory (imlabs.info) confirm the unsafe-deserialization root cause and the migration to safetensors.
Technical ContextAI
AnomalyMatch is the European Space Agency's semi-supervised anomaly-detection toolkit built on PyTorch. The vulnerability is a classic CWE-502 (Deserialization of Untrusted Data): SessionIOHandler.load_model and load_model_checkpoint invoked torch.load(load_path, weights_only=False) - and fell back to pickle.load() - on files inside the session checkpoints directory. Both torch.load (pre-2.6 default) and pickle.load execute arbitrary Python via __reduce__ during unpickling, so any attacker-controlled .pth or .pkl file becomes a code-execution primitive the moment a session is reopened. The upstream remediation replaces torch.save/torch.load with a new checkpoint_io module that uses HuggingFace safetensors (a tensor-only format with no executable payload) plus JSON-encoded metadata.
RemediationAI
Upgrade to ESA AnomalyMatch 1.3.1 or later, which replaces torch.save/torch.load and pickle.load with safetensors via the new anomaly_match/data_io/checkpoint_io module (see PR https://github.com/esa/AnomalyMatch/pull/9). Until the upgrade is applied, treat any pre-existing .pth or .pkl checkpoint as executable code: store session directories on per-user paths with restrictive POSIX permissions (chmod 700), never open sessions or checkpoints received from other users, collaborators, or public model repositories, and verify checksums against a known-good source before loading. If you must keep the unpatched version running, a stopgap is to patch the local load paths to call torch.load(..., weights_only=True) (PyTorch ≥2.0) or to refuse any checkpoint not matching an allowlisted SHA-256 - note that weights_only=True will break loading of legacy checkpoints that embedded non-tensor Python objects, so retraining or re-saving may be required.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today