Executive brief
Fujitsu's OneCompression library is a Python tool used to compress and optimize large language models for efficient deployment. A flaw in how the library loads model checkpoint files allows attackers to execute arbitrary code by supplying a malicious model file, potentially compromising systems where the library is used to load untrusted models. This could lead to data theft, system compromise, or lateral movement within an organization.
Technical details
The vulnerability is an unsafe deserialization flaw (CWE-502) in the QuantizedModelLoader.load_quantized_model_pt() function. The vulnerable code unconditionally calls torch.load() with weights_only=False, which invokes Python's pickle deserializer and allows arbitrary code execution during object reconstruction. An attacker can craft a malicious PyTorch checkpoint file (.pt) containing objects with malicious __reduce__ methods that execute arbitrary Python code, including system commands, when the library deserializes the file. The attack requires the victim to load a model from an attacker-controlled or compromised directory. The vulnerability was fixed in version 1.2.1 by properly restricting deserialization.
Affected products
- Fujitsu Research OneCompression before 1.2.1
Timeline
- 2026-08-12: disclosed
- 2026: patched: Fixed in version 1.2.1