| عنوان | piskvorky gensim <=4.4.0 rce |
|---|
| الوصف | Loading a gensim model file (the primary documented workflow — the tutorials distribute and load .model / .kv files) calls raw pickle.load on the file unconditionally, before any other logic:
# gensim/utils.py
@classmethod
def load(cls, fname, mmap=None): # :453 <- only param is mmap
...
compress, subname = SaveLoad._adapt_by_suffix(fname) # :483
obj = unpickle(fname) # :485 <- pickle runs HERE
obj._load_specials(fname, mmap, compress, subname) # :486 <- mmap used HERE (too late)
obj.add_lifecycle_event("loaded", fname=fname) # :487
return obj
def unpickle(fname): # :1445
...
with open(fname, 'rb') as f: # :1459
return _pickle.load(f, encoding='latin1') # :1460 *** RCE sink ***
A package-wide search for weights_only, allow_pickle, RestrictedUnpickler, safe_globals, find_class returns zero matches; a search for the words untrusted, unsafe, arbitrary, malicious across utils.py and the model loaders also returns zero matches — the load path carries no safety mechanism and no warning anywhere. |
|---|
| المصدر | ⚠️ https://github.com/piskvorky/gensim/issues/3663 |
|---|
| المستخدم | meraklbz (UID 87053) |
|---|
| ارسال | 29/08/2026 04:51 AM (23 أيام منذ) |
|---|
| الاعتدال | 20/09/2026 10:31 AM (22 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 408020 [piskvorky gensim حتى 4.4.0 Model Loader gensim/utils.py load fname تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|