Executive brief
gensim is a library used for topic modeling and word embeddings in machine learning applications. The library's model loading function uses Python's pickle deserializer without any protection, allowing an attacker to execute arbitrary code by crafting a malicious model file. Loading a compromised model from an untrusted source results in immediate code execution on the host system.
Technical details
The SaveLoad.load class method in gensim/utils.py unconditionally calls pickle.load on user-supplied model files before performing any validation or safety checks. An attacker can craft a pickled Python object that executes arbitrary system commands via the __reduce__ magic method when deserialized. The mmap parameter and other downstream processing occur after the pickle payload has already executed, offering no protection against this attack vector.
Affected products
- piskvorky gensim up to 4.4.0
Timeline
- 2026-09-20: disclosed
- 2026-08-29: other: Issue #3663 opened; maintainer closed same-day with no fix or comment