EUVD-2026-33701
GHSA-84q4-pj7g-82qq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.
AnalysisAI
Arbitrary code execution in ESA AnomalyMatch before 1.3.1 allows local attackers with low privileges to run code under the application's process by planting a malicious PyTorch checkpoint into a session directory, which is loaded via torch.load() with weights_only=False. No public exploit is identified at time of analysis, but the upstream fix (PR #9) and a third-party advisory (imlabs.info) confirm the unsafe-deserialization root cause and the migration to safetensors.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to place a malicious model checkpoint file (.pth or .pkl) into a path AnomalyMatch will load - specifically the session's checkpoints/ subdirectory referenced by SessionIOHandler.load_model or load_model_checkpoint - and then have a legitimate user (or automated job) open that session so torch.load(..., weights_only=False) or pickle.load() is invoked on the attacker file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) frames this as a local, low-complexity, low-privilege exploit with full CIA impact - consistent with a researcher dropping a poisoned checkpoint into a shared session directory on a multi-user analysis host or shared HPC node. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privileged access on a shared analysis workstation (or who can drop a file into a network-mounted session directory used by AnomalyMatch) places a crafted .pth checkpoint whose pickle stream contains a __reduce__ payload invoking os.system or similar. When an analyst later opens that session in AnomalyMatch, SessionIOHandler.load_model calls torch.load(..., weights_only=False) and the payload executes with the analyst's privileges. … |
| Remediation | Upgrade to ESA AnomalyMatch 1.3.1 or later, which replaces torch.save/torch.load and pickle.load with safetensors via the new anomaly_match/data_io/checkpoint_io module (see PR https://github.com/esa/AnomalyMatch/pull/9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all ESA AnomalyMatch deployments and versions in use; restrict filesystem access to session directories to the application service account only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Heap-based buffer overflow in stable-diffusion.cpp's pickle .ckpt parser allows attackers to corrupt memory and likely a
Heap buffer overflow in the leejet stable-diffusion.cpp pickle .ckpt parser allows arbitrary code execution when a user
Heap buffer overflow in stable-diffusion.cpp versions prior to master-584-0a7ae07 allows attackers to corrupt memory and
Arbitrary code execution in Stanford NLP's Stanza 1.12.0 (and ≤1.12.1) occurs when the library loads a malicious PyTorch
Unsafe deserialization in LangGraph SQLite Checkpoint's JsonPlusSerializer (versions 4.1.0 and prior) allows arbitrary P
Share
External POC / Exploit Code
Leaving vuln.today