Database/AI/ML frameworks & serving
PyTorch (`torch.load`): RCE via unsafe deserialization even with `weights_only=True`
Impact
RCE via unsafe deserialization even with weights_only=True
Who can reach it
Customer-supplied .pt/.pth checkpoint file loaded by any tenant job or by a provider-run model-import service
What to do
No host patch. Bump torch>=2.6.0 in every base image the provider ships; if the tenant pins an old torch in their own image, the provider cannot remediate — advise migration to safetensors. Shared responsibility: provider owns base images, tenant owns pinned envs
Fleet impact
How widespread
Universal - PyTorch ≤2.5.1 is in essentially every AI container image in every GPU fleet
Cost to remediate
**Image rebuild across the fleet** (node-drain for anything long-running) - the fix is torch>=2.6.0 inside every tenant and platform image; you cannot hot-patch a library already imported into a running training job
Why it hits the whole fleet
torch.load(weights_only=True) - the setting everyone was told was the safe one - is bypassable, so *every* checkpoint-loading path in the fleet is an RCE sink; 130+ public PoCs
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.