Tt Metal
Monthly
Path traversal in Tenstorrent tt-metal up to and including 0.80.0 lets a malicious model checkpoint direct the loader to read a safetensors shard from outside the checkpoint directory, because weight_map filenames in model.safetensors.index.json are joined onto the checkpoint path without containment checking. The weakness is reachable remotely but gated by user interaction: someone must actually load an untrusted or attacker-supplied checkpoint, and the impact is read-oriented (an out-of-directory shard is pulled into the loaded state dict) rather than direct code execution, which is why the assessed severity is low (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; upstream CVSS 4.0 score 2.1). Publicly available exploit code exists and the vendor has released a fix in v0.81.0-dev20261016; there is no indication of confirmed active exploitation (CISA KEV).
Path traversal in Tenstorrent tt-metal up to and including 0.80.0 lets a malicious model checkpoint direct the loader to read a safetensors shard from outside the checkpoint directory, because weight_map filenames in model.safetensors.index.json are joined onto the checkpoint path without containment checking. The weakness is reachable remotely but gated by user interaction: someone must actually load an untrusted or attacker-supplied checkpoint, and the impact is read-oriented (an out-of-directory shard is pulled into the loaded state dict) rather than direct code execution, which is why the assessed severity is low (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; upstream CVSS 4.0 score 2.1). Publicly available exploit code exists and the vendor has released a fix in v0.81.0-dev20261016; there is no indication of confirmed active exploitation (CISA KEV).