CVE-2026-108947 in torchdistill

Prediction

by VulDB Data Team • 10/11/2026

A flaw has been found in <a href="/product/yoshitomo-matsubara:torchdistill">yoshitomo-matsubara torchdistill up to 1.1.5</a>. This affects the function <code>load_ckpt</code> of the file <em>torchdistill/common/main_util.py</em>. Executing a manipulation of the argument <em>src_ckpt</em> can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: &quot;This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate.&quot;

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-416771
• CPE: VulDB
• CWE: CWE-502 (confirmed)
• Exploit: Download
• CVSS: 5.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-108947
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-108947
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-108947/