| Title | Dexmal Dexbotic commit 21db59bace4cebc05197160adf3a9eccd208b664 Path Traversal |
|---|
| Description | A vulnerability was found in Dexmal Dexbotic up to commit 21db59bace4cebc05197160adf3a9eccd208b664 (version 0.2.0, same code still present at main HEAD 5b22b19c72124a7b5fc581f7c895f23c33b20353) and classified as high 7.1. Affected is the load_pretrained_gr00t function of the gr00tsonic checkpoint loader component (dexbotic/model/gr00tsonic/gr00tsonic_arch.py, lines 363-377). The manipulation of the weight_map values in a checkpoint's model.safetensors.index.json leads to a path traversal. It is possible to launch the attack remotely with a crafted checkpoint package; user interaction is required because the victim must run the documented gr00tsonic initialization/training on it.
Technical Details
- Affected file/function: dexbotic/model/gr00tsonic/gr00tsonic_arch.py / load_pretrained_gr00t()
- Vulnerable parameter: weight_map shard path values of model.safetensors.index.json
- Attack vector: Network (the crafted Isaac-GR00T checkpoint is delivered as a model-hub download, mirror or shared archive)
- Privileges required: None
- Trigger condition: the loader joins every weight_map value onto the checkpoint directory with os.path.join and passes the result to safetensors.torch.load_file with no containment check; a value that is an absolute path discards the checkpoint-directory prefix entirely. The loaded tensors are remapped and written into the model with load_state_dict(strict=False), so attacker-chosen out-of-package tensor values silently replace model weights (missing=0, unexpected=0, no warning). A differential with two checkpoint packages byte-identical except one index string loads out-of-package 0.625 instead of in-package -0.25; a nonexistent absolute path yields a FileNotFoundError that echoes the attacker-chosen path.
Impact
- Confidentiality: Low (no direct readback; out-of-package values embedded into model parameters enable indirect exfiltration if the poisoned model is republished; limited filesystem oracle via distinguishable errors)
- Integrity: High (silent arbitrary replacement of Vision-Language-Action robot policy weights at initialization)
- Availability: None
CVSS v3.1
Score: 7.1 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Timeline
- Discovered: 2026-10-10
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Reject absolute paths and .. segments in every weight_map value and verify containment of the resolved path inside the checkpoint directory before load_file (gr00tsonic_arch.py line 366), e.g. shard = Path(ckpt_path) / v followed by shard.resolve().is_relative_to(Path(ckpt_path).resolve()); add a regression test with an absolute weight_map value. Interim workaround: only initialize from checkpoints whose index shard names have been manually checked, and load untrusted packages in an isolated environment. |
|---|
| Source | ⚠️ https://github.com/dexmal/dexbotic/issues/103 |
|---|
| User | Dem000000 (UID 98564) |
|---|
| Submission | 10/11/2026 14:21 (16 days ago) |
|---|
| Moderation | 10/27/2026 10:01 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427076 [Dexmal Dexbotic up to 0.2.0 gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t weight_map path traversal] |
|---|
| Points | 20 |
|---|