EUVD-2026-39110
GHSA-cv8h-j5cx-fg4f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local because exploitation requires the victim to load a malicious checkpoint file (AV:L/UI:R); no privileges needed (PR:N), and arbitrary code execution yields full C/I/A impact.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27990.
AnalysisAI
Arbitrary code execution in MosaicML Composer arises when the library loads a model or resumption checkpoint, because checkpoint parsing deserializes attacker-controlled pickle data without validation (CWE-502). A user who loads a maliciously crafted checkpoint (.pt) file - for example one downloaded from a model hub or shared by a collaborator - runs arbitrary Python code in the context of the training process. Reported through ZDI (ZDI-26-384, ZDI-CAN-27990); no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but an upstream source fix is available.
Technical ContextAI
MosaicML Composer is an open-source PyTorch training library used to train and fine-tune deep-learning models, with built-in support for saving and resuming from checkpoints. The vulnerable code path is checkpoint loading: composer/checkpoint/load.py used a bare pickle.load() on resumption checkpoints, and composer/utils/checkpoint.py called torch.load(..., weights_only=False), both of which invoke Python's pickle machinery. Pickle deserialization can instantiate arbitrary objects and invoke their __reduce__ methods (e.g. os.system), the canonical CWE-502 'Deserialization of Untrusted Data' root cause. The fix introduces a _RestrictedUnpickler that allowlists only known-safe globals (builtins, collections, numpy, torch tensor rebuild helpers) and switches torch.load to weights_only=True wrapped in torch.serialization.safe_globals(), so untrusted checkpoints can no longer reach dangerous callables. Affected per CPE: cpe:2.3:a:mosaicml:composer (all versions prior to the fix).
RemediationAI
Upstream fix available (PR/commit); a released patched version is not independently confirmed from the available data - track the MosaicML Composer release that incorporates commit 6405188805a0054b4551ec49e4919c54c971d0e8, which replaces unguarded pickle.load with a _RestrictedUnpickler allowlist and switches torch.load to weights_only=True with torch.serialization.safe_globals(). Until a tagged patched release is pinned, the primary compensating control is to never load checkpoints from untrusted or unverified sources: load only checkpoints you generated or that are cryptographically verified (checksums/signatures) from a trusted artifact store, accepting that this restricts usable files to known-good ones. Where you control the loading code, force torch.load(..., weights_only=True) and avoid weights_only=False, noting that some legacy checkpoints serializing non-tensor objects (e.g. metric objects) may then fail to load and require load_ignore_keys (e.g. state/train_metrics/*, state/eval_metrics/*) to skip unsupported entries. Treat checkpoint files like executable code in CI/CD and isolate checkpoint-loading processes (least-privilege accounts, containers/sandboxing) to limit blast radius. Advisory references: https://www.zerodayinitiative.com/advisories/ZDI-26-384/ and the fix commit URL above.
Composer is a dependency manager for PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, lo
Command injection in PHP Composer's Perforce VCS handler allows arbitrary local command execution with the privileges of
The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in th
Composer is an open source dependency manager for the PHP language. Rated critical severity (CVSS 9.8), this vulnerabili
Composer is a dependency manager for PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, lo
Composer is a dependency manager for the PHP programming language. Rated high severity (CVSS 8.8), this vulnerability is
Arbitrary file write in Composer (the PHP dependency manager) before 2.2.29 and 2.10.2 allows a malicious package served
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all ver
Path traversal in Composer's binary installation flow allows a malicious PHP package to cause arbitrary host files to be
Improper input validation in the Drupal Composer contributed module (SA-contrib-2026-046) exposes sites to confidentiali
Credential leakage in Composer PHP dependency manager exposes sensitive tokens - such as GitHub Personal Access Tokens e
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today