Dexbotic
Monthly
Path traversal in the Dexbotic gr00tsonic Checkpoint Loader (dexbotic/model/gr00tsonic/gr00tsonic_arch.py, function load_pretrained_gr00t) allows an attacker who controls the weight_map argument to cause file paths outside the intended checkpoint location to be used during checkpoint loading. Dexbotic 0.1 and 0.2.0 are listed as affected (CPE cpe:2.3:a:dexmal:dexbotic:*), and exploitation is remote but requires the victim to actually load an attacker-influenced pretrained checkpoint - per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector no authentication is needed, while passive user interaction is the primary limiting factor. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists but it is not verified as working exploit code, and the project has been notified through an issue report without a response, so the issue is assessed as low priority (monitor).
Path traversal in the Dexbotic gr00tsonic Checkpoint Loader (dexbotic/model/gr00tsonic/gr00tsonic_arch.py, function load_pretrained_gr00t) allows an attacker who controls the weight_map argument to cause file paths outside the intended checkpoint location to be used during checkpoint loading. Dexbotic 0.1 and 0.2.0 are listed as affected (CPE cpe:2.3:a:dexmal:dexbotic:*), and exploitation is remote but requires the victim to actually load an attacker-influenced pretrained checkpoint - per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L vector no authentication is needed, while passive user interaction is the primary limiting factor. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists but it is not verified as working exploit code, and the project has been notified through an issue report without a response, so the issue is assessed as low priority (monitor).