CVE-2025-23298

Summary: CVE-2025-23298 affects NVIDIA Merlin Transformers4Rec. A vulnerability arises from a Python dependency in Transformers4Rec where loading a checkpoint with PyTorch’s torch.load() can deserialize objects via Python’s pickle, enabling arbitrary code execution. This could allow an attacker t...