| tiêu đề | DLR-RM stable-baselines3 v2.9.0 rce |
|---|
| Mô tả | Three independent sinks unpickle user-supplied files with no gating parameter and no environment variable: (1) PPO.load — the zip's data member carries base64 ":serialized:" fields decoded by cloudpickle.loads (save_util.py:165); (2) load_replay_buffer — raw pickle.load (save_util.py:370); (3) VecNormalize.load — raw pickle.load (vec_normalize.py:320). Serialized RL artifacts (model zips, replay buffers, normalization stats) are commonly shared, making the file source attacker-controllable in practice. Note the contrast inside load_from_zip_file: PyTorch tensors are loaded with th.load(..., weights_only=True) (save_util.py:442) — the tensor path is hardened while the three pickle/cloudpickle paths stay open. custom_objects cannot help: it replaces dict entries after cloudpickle.loads has already executed; the other APIs take no comparable argument. |
|---|
| Nguồn | ⚠️ https://github.com/DLR-RM/stable-baselines3/issues/2281 |
|---|
| Người dùng | __lbz__ (UID 100868) |
|---|
| Đệ trình | 29/08/2026 08:02 (cách đây 22 ngày) |
|---|
| Kiểm duyệt | 20/09/2026 10:39 (22 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 408021 [DLR-RM stable-baselines3 đến 2.9.0 save_util.py PPO.load/load_replay_buffer/VecNormalize.load nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|