Database/AI/ML frameworks & serving
vLLM (weight loading): `hf_model_weights_iterator` uses `torch.load` without `weights_only`
CVE-2025-24357AI/ML frameworks & servingcurated
Impact
hf_model_weights_iterator uses torch.load without weights_only → RCE
Who can reach it
Customer-supplied Hub checkpoint
What to do
Upgrade; a serving engine loading pickle weights inherits every PyTorch pickle CVE
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.