HashNeRF-pytorch EUVD-2026-43277

Exploitation requires local system access and low-privileged user permissions, as confirmed by CVSS 4.0 AV:L/PR:L. The attacker must be able to supply or influence the ckpt_path argument passed to torch.load() in run_nerf.py, either by directly controlling the command-line argument, by writing a malicious file to a path the application is configured to load, or by intercepting a shared checkpoint directory. No network access, administrative privileges, or user interaction beyond triggering the training script are required. Exploitation is not possible when ckpt_path is always resolved from a write-protected, trusted-only directory inaccessible to the attacker. Systems where checkpoint loading is never performed or where weights_only=True is already enforced are not exploitable via this vector.

The CVSS 4.0 score of 4.8 (Medium) with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N accurately reflects an attack constrained to local access with low-privilege requirements. No EPSS score was included in the provided intelligence, so probabilistic exploitation frequency cannot be quantified. The E:P supplemental metric confirms publicly available exploit code, which materially lowers the skill barrier for exploitation beyond what the medium CVSS score implies. The product is not listed in CISA KEV, consistent with a niche research tool unlikely to be a mass-exploitation target. The scope is non-changing (S:U / SC:N/SI:N/SA:N), meaning a successful exploit does not pivot laterally to other systems by design - impact is confined to the process owner on the vulnerable host. For ML researchers and data scientists who routinely share and load community checkpoint files, the real-world risk is practically higher than the score suggests, since the threat model of loading externally sourced checkpoints is common in this domain. The unmerged patch status increases residual exposure.

A local attacker with low-privileged shell access on a machine running HashNeRF-pytorch crafts a .pt checkpoint file that embeds a malicious pickle payload - for example, a reverse shell or credential harvester - using publicly documented PyTorch pickle injection techniques. The attacker places the file at a path the victim user or automated training pipeline will supply as ckpt_path, then waits for run_nerf.py to be invoked; upon torch.load() deserializing the file, the payload executes in the context of the training process. A public proof-of-concept demonstrating this attack path has been disclosed via GitHub issue #49.