CVE-2026-117510

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

EUVD-2026-111084

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

CVE-2026-117510

A path traversal vulnerability exists in Dexmal Dexbotic up to version 0.2.0 . The flaw is located within the load_pretrained_gr00t function of the gr00tsonic_arch.py file in the gr00tsonic Checkpoint Loader component. By manipulating the weight_map argument, an attacker can perform a path traver...

CVE-2026-117510 Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

CVE-2026-117510 Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

CVE-2026-117510 Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

CVE-2026-117510: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

Dexmal One-Stop VLA Development Toolbox for Embodied Intelligence path traversal vulnerability

Versions 0.2.0 and earlier of the Dexmal One-Stop VLA Development Toolbox for Embodied Intelligence contain a path traversal vulnerability. This vulnerability stems from improper handling of the parameter weightmap in the loadpretrainedgr00t function within the file...

PT-2026-126637

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load pretrained gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight map causes path traversal...

EUVD-2026-55743

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...

MONAI: Unsafe torch usage may lead to arbitrary code execution

Summary In modeldict = torch.loadfullpath, maplocation=torch.devicedevice, weightsonly=True in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading methods still exist elsewhere in the project, such as when loading checkpoints. This is a common practice when...