CVE-2026-31218
HighSummary
The _load_model() function in the neural_magic_training.py script of the optimate project is vulnerable to insecure deserialization. The lack of enabling the weights_only=True security parameter when loading the state_dict.pt file allows for the deserialization of arbitrary Python objects, potentially leading to arbitrary code execution.
Risk Assessment
An attacker can exploit this vulnerability by providing a maliciously crafted state_dict.pt file, leading to potential arbitrary code execution on the victim's system. This poses a serious security threat to the organization's systems.
Recommendation
It is recommended to enable the weights_only=True parameter in the _load_model() function and conduct a code audit to eliminate risky deserialization operations. Access to state_dict.pt files should also be restricted to trusted sources.
Other vulnerabilities in neural_magic_training.py
See all- CVE-2026-31219High
The _load_model() function in the neural_magic_training.py script of the optimate project is vulnerable to insecure deserialization. This allows a malicious attacker to execute arbitrary code on the victim's system by providing a crafted model file.
- CVE-2026-31217Critical
The _load_model() function in the neural_magic_training.py script of the optimate project allows arbitrary code execution. A user can supply a directory path via the --model command-line argument, which allows reading and executing the module.py file from that directory without validating its content.
Original NVD description (English source)
The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable to insecure deserialization (CWE-502). When loading a model state dictionary from a state_dict.pt file via torch.load(), the function does not enable the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects through the Pickle module. A remote attacker can exploit this by providing a maliciously crafted state_dict.pt file within a directory specified via the --model argument, leading to arbitrary code execution during the deserialization process on the victim's system.