| Title | yoshitomo-matsubara torchdistill up to 1.1.5 Insecure Deserialization |
|---|
| Description | A vulnerability was found in torchdistill up to 1.1.5 and classified as high 7.8.
Affected is the load_ckpt function of the torchdistill/common/main_util.py component.
The manipulation of the argument src_ckpt (checkpoint file path taken from the YAML
configuration) leads to insecure deserialization. It is possible to launch the attack
locally by supplying a crafted .pt/.ckpt checkpoint.
Technical Details
- Affected file/function: torchdistill/common/main_util.py / load_ckpt(), lines 310-311
at commit 74ce91cdc0e5c3115fe7bacaea32a65207283c4a (current main HEAD); reached via
torchdistill/core/training.py:93-95 and torchdistill/core/distillation.py:100-102,116-118
- Vulnerable parameter: models.*.src_ckpt checkpoint path in the YAML config
- Attack vector: Local (malicious checkpoint file placed on the victim's filesystem and
referenced by a training/eval/distillation config)
- Privileges required: Low
- Trigger condition: torch.load(ckpt_file_path, weights_only=False, map_location='cpu')
deserializes the file with full pickle enabled (explicit opt-out of the PyTorch >= 2.6
secure default weights_only=True). A pickle __reduce__ payload executes during
torch.load, before any tensor-structure validation by load_full_state_dict(). The
existence-only check (check_if_exists) performs no integrity or provenance validation.
- Reproduced: 2026-09-24 on WSL2 Ubuntu (python 3.12.3, torch 2.14.0+cpu) against the
pinned commit; the same file under torch's own weights_only=True default is rejected
with UnpicklingError.
Impact
- Confidentiality: High (arbitrary code execution with the user's privileges)
- Integrity: High (arbitrary code execution)
- Availability: High (arbitrary code execution)
CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-24
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Load src_ckpt checkpoints with the secure default (weights_only=True), catch
UnpicklingError for legacy files with a clear re-save message, and gate any remaining
opt-out behind an explicit documented trust flag. |
|---|
| Source | ⚠️ https://github.com/yoshitomo-matsubara/torchdistill/issues/550 |
|---|
| User | Dem0 (UID 82596) |
|---|
| Submission | 09/24/2026 17:01 (17 days ago) |
|---|
| Moderation | 10/11/2026 20:58 (17 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416771 [yoshitomo-matsubara torchdistill up to 1.1.5 main_util.py load_ckpt src_ckpt deserialization] |
|---|
| Points | 20 |
|---|