Executive brief
tilelang is a domain-specific language for developing high-performance GPU kernels. A vulnerability in its kernel cache mechanism allows arbitrary code execution if an attacker can write to the cache directory. An affected user simply running tilelang with a compromised cache would execute attacker-controlled code without any additional interaction.
Technical details
A deserialization vulnerability exists in the KernelCache._load_kernel_from_disk function (tilelang/cache/kernel_cache.py), which uses cloudpickle.load() to deserialize cached kernel parameters from a params.pkl file. If an attacker can write to the cache directory—such as through a shared system, writable /tmp location, or supply-chain compromise—they can inject a malicious pickle file that executes arbitrary Python code when deserialized on the next cache load. The vulnerability requires local file write access but no authentication or user interaction. The fix, merged in commit 11ec2397fe942e8b422d026af4a03d6e0a55ae6c, replaces cloudpickle serialization with JSON via TVM's reflection (tvm.ir.save_json / load_json), eliminating code execution during deserialization. This patch has not yet been released in an official version.
Affected products
- tile-ai tilelang up to 0.1.14
Timeline
- 2026-09-09: disclosed
- 2026-09-06: patched: Patch commit 11ec2397fe942e8b422d026af4a03d6e0a55ae6c; not yet in official release