CVE-2026-24747

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=True)`, can corrupt memory and potentially lead to arbitrary code execution. Version 2.10.0 fixes the issue.

Attacker uploads a malicious PyTorch checkpoint to HuggingFace Hub, disguising it as a popular fine-tuned LLM variant (e.g., a Llama or Mistral derivative). The file is crafted to exploit the weights_only unpickler bypass, embedding a reverse shell payload inside the serialized structure. A data scientist discovers it via model search, downloads it, and runs `model = torch.load('model.pth', weights_only=True)` during local evaluation or in a shared GPU cluster job. The malicious payload executes, establishing persistence on the training node, from which the attacker pivots to cloud storage buckets containing training data and proprietary model weights. Alternatively, in a supply chain scenario, the attacker compromises an internal model registry and replaces a trusted checkpoint—every training job and serving deployment that hot-reloads the model is then compromised without any user interaction beyond normal operations.