Onecompression
Monthly
Arbitrary code execution in Fujitsu Research's OneCompression (onecomp) Python library 1.2.0 is triggered when a victim loads a crafted PyTorch checkpoint file via the library's QuantizedModelLoader API, which unconditionally invokes Python's pickle machinery. The root cause is the hardcoded use of torch.load with weights_only=False in load_quantized_model_pt(), allowing an attacker-supplied checkpoint to embed malicious __reduce__ methods that execute arbitrary Python - including OS commands - in the context of the loading process. No public exploit code has been identified at time of analysis, though a patched version (1.2.1) is available on PyPI per the VulnCheck advisory.
Arbitrary code execution in Fujitsu Research's OneCompression (onecomp) Python library 1.2.0 is triggered when a victim loads a crafted PyTorch checkpoint file via the library's QuantizedModelLoader API, which unconditionally invokes Python's pickle machinery. The root cause is the hardcoded use of torch.load with weights_only=False in load_quantized_model_pt(), allowing an attacker-supplied checkpoint to embed malicious __reduce__ methods that execute arbitrary Python - including OS commands - in the context of the loading process. No public exploit code has been identified at time of analysis, though a patched version (1.2.1) is available on PyPI per the VulnCheck advisory.