Tilelang
Monthly
Deserialization of untrusted data in tile-ai tilelang versions 0.1.0 through 0.1.14 allows an attacker who can write to the kernel cache directory to achieve arbitrary code execution by planting a crafted `params.pkl` file in the cache path. The `KernelCache._load_kernel_from_disk` function previously used cloudpickle to deserialize cached kernel parameters from disk without validation, a classic CWE-502 pattern that permits executing arbitrary Python code at deserialization time. The upstream fix (commit 11ec2397, PR #3143) replaces cloudpickle with TVM's `tvm.ir.save_json`-based JSON serialization, which cannot execute code, but no official patched release has been published at time of analysis.
Deserialization of untrusted data in tile-ai tilelang versions 0.1.0 through 0.1.14 allows an attacker who can write to the kernel cache directory to achieve arbitrary code execution by planting a crafted `params.pkl` file in the cache path. The `KernelCache._load_kernel_from_disk` function previously used cloudpickle to deserialize cached kernel parameters from disk without validation, a classic CWE-502 pattern that permits executing arbitrary Python code at deserialization time. The upstream fix (commit 11ec2397, PR #3143) replaces cloudpickle with TVM's `tvm.ir.save_json`-based JSON serialization, which cannot execute code, but no official patched release has been published at time of analysis.