Which versions of OneCompression are affected by EUVD-2026-57313?

Fujitsu Research's OneCompression Python library version 1.2.0 contains a critical arbitrary code execution vulnerability that allows attackers to execute malicious commands when organization members…. A patch is available.

How to fix or mitigate EUVD-2026-57313?

Within 24 hours: identify all internal systems and development environments running OneCompression 1.2.0 by scanning package manifests and container registries. Within 7 days: update all affected instances to version 1.2.1 or later, prioritizing production systems and isolated ML development environments that process external or untrusted checkpoint files. Within 30 days: conduct a security audit of any checkpoint files processed by vulnerable installations over the past 6 months to detect compromise indicators, and implement file validation controls requiring cryptographic verification and checksums of model sources.

OneCompression EUVD-2026-57313

Q: What is the CVSS score of EUVD-2026-57313?

EUVD-2026-57313 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-73325 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-12 VulnCheck

GHSA-f3q7-jj9x-2wjr

RCE Python Deserialization Checkpoint Onecompression

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

AV:L because malicious file must be on local filesystem; UI:R because victim must invoke the load; PR:N as no privileges needed to craft payload; S:U as no scope change per CVSS 4.0 SC/SI/SA all N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 16:21 vuln.today

CVE Published

Aug 12, 2026 - 15:35 cve.org

HIGH 8.4

DescriptionCVE.org

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.

Articles & Coverage 1

News 5 New Python Vulnerabilities - 1 Critical, 4 High, 2 With POC Aug 13, 2026

AnalysisAI

Arbitrary code execution in Fujitsu Research's OneCompression (onecomp) Python library 1.2.0 is triggered when a victim loads a crafted PyTorch checkpoint file via the library's QuantizedModelLoader API, which unconditionally invokes Python's pickle machinery. The root cause is the hardcoded use of torch.load with weights_only=False in load_quantized_model_pt(), allowing an attacker-supplied checkpoint to embed malicious __reduce__ methods that execute arbitrary Python - including OS commands - in the context of the loading process. No public exploit code has been identified at time of analysis, though a patched version (1.2.1) is available on PyPI per the VulnCheck advisory.

Technical ContextAI

PyTorch's torch.load function supports two deserialization modes: weights_only=True (safe, restricts unpickling to tensor primitives) and weights_only=False (unsafe, invokes Python's full pickle machinery). PyTorch deprecated and then restricted the unsafe mode precisely because .pt/.pth checkpoint files are serialized Python objects, and pickle's __reduce__ protocol allows arbitrary class instantiation and code execution at deserialization time. The affected component, QuantizedModelLoader.load_quantized_model_pt() in cpe:2.3:a:fujitsu_research:onecompression:*:*:*:*:*:*:*:* version 1.2.0, hardcodes weights_only=False, meaning any caller passing an untrusted checkpoint path exposes the process to full code execution. CWE-502 (Deserialization of Untrusted Data) precisely captures this class: the application trusts the structure and content of a serialized object from an untrusted source without validation.

RemediationAI

Upgrade the onecomp package to version 1.2.1 immediately via pip install --upgrade onecomp; this is the vendor-released patch confirmed on PyPI at https://pypi.org/project/onecomp/1.2.1/. If an immediate upgrade is not feasible, the specific compensating control is to avoid calling load_quantized_model_pt() with any checkpoint file sourced from an untrusted or unverified origin - restrict model loading to files with a verified cryptographic signature or hash checked against a trusted manifest before the load call. As an alternative workaround in code, callers can monkey-patch or wrap the loader to intercept the torch.load call and enforce weights_only=True, though this may break loading of models that include non-tensor objects and requires testing for compatibility. Do not rely on filesystem permissions alone, as the vulnerability is in the deserialization of the file content, not file access control.