cve-2025-32434-poc

CVE-2025-32434 描述 技术细节 漏洞入口点是 torch/serialization.py 中的 load 函数 当保护（weightsonly）启用时： 加载 tar 文件会依次调用以下函数： 1. load: torch/serialization.py:1117 2. loadlegacy: torch/serialization.py:1376 至 torch/serialization.py:1406 3. persistentload: torch/serialization.py:1474 4. picklemodule.load:...

CVE-2025-32434

CVE-2025-32434：PyTorch远程代码执行漏洞 - PoC 什么是CVE-2025-32434？ CVE-2025-32434 是PyTorch中的一个严重远程代码执行（RCE）漏洞，PyTorch是深度学习和神经网络中广泛使用的Python库。 核心问题 该漏洞存在于torch.load函数中，即使使用了看似安全的weightsonly=True参数。weightsonly=True选项旨在通过仅允许加载模型参数来防止代码执行。然而，研究人员找到了一种绕过此保护的方法。 受影响版本 状态| 版本 ---|--- 有漏洞| PyTorch 2.5.1及更早版本 已修复|...

CVE-2025-32434-exploit

概述 此漏洞利用程序展示了 PyTorch 版本低于 2.6.0 中存在的一个严重远程代码执行漏洞（CVE-2025-32434）。该缺陷存在于 torch.load 函数中，即使使用了本应阻止模型反序列化过程中任意代码执行的 weightsonly=True 参数，仍然无法避免。 该漏洞的产生原因是 weightsonlyunpickler 实现未能正确限制反序列化，攻击者可以构造恶意的 .pt 模型文件，在易受攻击的 PyTorch 安装加载该文件时执行任意系统命令。 受影响版本：PyTorch /tmp/whoami" Test the exploit loads the mode...

EUVD-2026-77001

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weightsonly=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or...

NewStart CGSL MAIN 7.02 : pytorch Vulnerability (NS-SA-2026-0105)

The remote NewStart CGSL host, running version MAIN 7.02, has pytorch packages installed that are affected by a vulnerability: - PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a...

PYSEC-2026-3967

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

PYSEC-2026-3967

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the loadstate function that imports and executes attacker-controlled module names from checkpoint instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass...

Snorkel Trainer.load uses an unsafe torch.load

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability CWE-502 in the Trainer.load method of the Trainer class. The method loads model checkpoint files using torch.load without enabling the security-restrictive weightsonly=True parameter. This default behavior allows...

CVE-2026-31219

The loadmodel function in the neuralmagictraining.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f 2024-07-21 is vulnerable to insecure deserialization CWE-502. When a user provides a single model file path e.g., .pt or .pth via the --model command-line argumen...

CVE-2026-31249

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e 2025-30-21 contains an insecure deserialization vulnerability CWE-502 in its makeparquetlist.py data processing tool. The script loads PyTorch .pt files utterance embeddings, speaker embeddings, speech tokens using torch.load without...

AZL-75293 CVE-2026-24747 affecting package pytorch for versions less than 2.2.2-11

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a malicious checkpoint file .pth that, when loaded with torch.load..., weightsonly=True, can corrupt memory and potentially lead to...

PYSEC-2026-2286

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a malicious checkpoint file .pth that, when loaded with torch.load..., weightsonly=True, can corrupt memory and potentially lead to...

UBUNTU-CVE-2026-24747

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a malicious checkpoint file .pth that, when loaded with torch.load..., weightsonly=True, can corrupt memory and potentially lead to...

CVE-2026-24747

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's weightsonly unpickler allows an attacker to craft a malicious checkpoint file .pth that, when loaded with torch.load..., weightsonly=True, can corrupt memory and potentially lead to...

CVE-2025-58756 MONAI's unsafe torch usage may lead to arbitrary code execution

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in modeldict = torch.loadfullpath, maplocation=torch.devicedevice, weightsonly=True in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading method...

GHSA-GGPF-24JW-3FCW CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

Description https://github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54 reported a vulnerability where loading a malicious model could result in code execution on the vllm host. The fix applied to specify weightsonly=True to calls to torch.load did not solve the problem prior to...

CVE-2025-32434

PyTorch contains a Remote Command Execution (RCE) vulnerability in versions 2.5.1 and earlier when loading a model with torch.load and weights_only=True. The issue is publicly documented and has been patched in version 2.6.0. External notices reiterate that upgrading to 2.6.0+ mitigates the flaw;...

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

Description I found a Remote Command Execution RCE vulnerability in PyTorch. When loading model using torch.load with weightsonly=True, it can still achieve RCE. Background knowledge https://github.com/pytorch/pytorch/security As you can see, the PyTorch official documentation considers using...