| Titolo | TensorLayer 2.2.4 (commit 0681633); master branch unfixed as of 2026-09-24 Insecure Deserialization |
|---|
| Descrizione | A vulnerability was found in TensorLayer 2.2.4 and classified as high 8.8.
Affected is the load_hdf5_graph function of the tensorlayer/files/utils.py component
(reached through the documented tl.models.Model.load API). The manipulation of the
model_config root attribute of a .hdf5 model file leads to insecure deserialization:
the attribute value is passed to Python eval() without validation, so a crafted model
file executes arbitrary Python code during load. It is possible to launch the attack
remotely by distributing a malicious .hdf5 file. User interaction is required because
the victim must load the crafted file through the documented model-loading API. The
attack is silent: the payload evaluates to a valid configuration tuple, so the model
still restores successfully and the process exits normally.
Technical Details
- Affected file/function: tensorlayer/files/utils.py / load_hdf5_graph() (eval at
line 322, verified at commit 0681633); entry point tensorlayer/models/core.py:814
- Vulnerable parameter: model_config root attribute of the HDF5 model file
- Attack vector: Network (crafted model file shared via model hub/download)
- Privileges required: None
- Trigger condition: victim calls tl.models.Model.load(filepath, load_weights=False)
on an attacker-supplied .hdf5 file; f.attrs["model_config"].decode('utf8') is
evaluated with eval() before any parsing. A benign canary embedded in the attribute
executed and the model restored with exit code 0 in an offline Docker environment
(dynamic verification, library-API level); a benign negative control loaded clean.
A related cloudpickle.loads() sink (tensorlayer/files/utils.py:212, generate_func/
str2func) exists on the same code path but was not dynamically exercised.
Impact
- Confidentiality: High (arbitrary code execution exposes the loading process,
its files and environment secrets)
- Integrity: High (attacker code can modify files, models and process state)
- Availability: High (attacker code can disrupt or terminate the process)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: [unknown] (dynamic verification completed 2026-09-24)
- Vendor notified: [pending]
- Patch released: [pending] (master still affected as of 2026-09-24)
- Public disclosure: [pending]
Countermeasure
Replace eval(model_config_str) with ast.literal_eval() — the legitimate writer
(str(model_config)) only emits literal structures — and gate the str2func()/
cloudpickle.loads() branch behind an explicit opt-in trust flag. Until patched,
do not load .hdf5 model files from untrusted sources. |
|---|
| Fonte | ⚠️ https://github.com/tensorlayer/TensorLayer/issues/1169 |
|---|
| Utente | Dem0 (UID 82596) |
|---|
| Sottomissione | 24/09/2026 17:30 (18 giorni fa) |
|---|
| Moderazione | 11/10/2026 21:23 (17 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 416777 [TensorLayer fino a 2.2.4 HDF5 Loading utils.py load_hdf5_graph model_config escalationi di privilegi] |
|---|
| Punti | 20 |
|---|