Executive brief
AnomalyMatch is an AI system developed by the European Space Agency to identify unusual astronomical objects in large datasets. A security flaw in how the software handles saved AI model files allows an attacker to execute malicious code on a user's computer. This occurs if a user is tricked into loading a specially crafted 'checkpoint' file, potentially leading to a full system takeover or data theft.
Technical details
ESA AnomalyMatch versions prior to 1.3.1 utilize the `torch.load()` function with `weights_only=False` (default behavior in older PyTorch versions) to load model checkpoints. This function relies on the Python `pickle` module, which is inherently insecure against untrusted data. An attacker can create a malicious `.pth` or `.pkl` file containing a serialized payload that executes arbitrary commands when deserialized. The vulnerability is triggered when the application loads these files from session directories. The fix, introduced in version 1.3.1, migrates the serialization format to `safetensors`, which uses JSON for metadata and raw bytes for tensors, effectively eliminating the risk of code execution during loading.
Affected products
- European Space Agency (ESA) AnomalyMatch < 1.3.1
Timeline
- 2026-03-27: patched: Fix merged into main repository via pull request #9
- 2026-05-11: advisory: Version 1.3.1 released with the fix
- 2026-05-26: disclosed: Detailed security advisory published by researcher Ivan Markovic
- 2026-06-01: advisory: CVE-2026-38950 published in NVD