Executive brief
A utility script in the ml-engineering project, used for optimizing machine learning model checkpoints, contains a security flaw in how it handles data files. By processing a specially crafted checkpoint file, an attacker can execute malicious commands on the user's system. This could lead to a total compromise of the machine used for machine learning development or model training.
Technical details
The `torch-checkpoint-shrink.py` script in the `ml-engineering` repository (specifically commit 0099885db36a8f06556efe1faf552518852cb1e0) is vulnerable to insecure deserialization (CWE-502). The vulnerability exists in the `shrink_pt_file` function, which calls `torch.load()` on user-supplied `.pt` files without setting `weights_only=True`. Because `torch.load()` uses the Python `pickle` module by default, it can be coerced into instantiating arbitrary Python objects. A remote attacker who can provide a malicious checkpoint file to be processed by this script can achieve arbitrary code execution with the privileges of the user running the script. No authentication is required if the attacker can influence the files processed by the utility.
Affected products
- stas00 ml-engineering commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27)
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory