PyTorch torch.load remote code execution vulnerability with weights_only=True
A remote code execution vulnerability was discovered in PyTorch's torch.load function when used with the weights_only=True parameter, which had been documented as a secure way to load model weights. The vulnerability affects versions up to 2.5.1 and was patched in version 2.6.0.
What happened
A remote code execution (RCE) vulnerability was identified in PyTorch's torch.load function when called with weights_only=True. PyTorch documentation had considered this parameter setting to be safe for loading model weights, contrasting with the unsafe weights_only=False setting.
Reported impact
The vulnerability affects PyTorch versions up to 2.5.1 and allows remote code execution despite the weights_only=True security parameter being enabled.
Index analysis
The vulnerability undermines PyTorch's documented security recommendation that using torch.load with weights_only=True mitigates security issues commonly associated with loading untrusted model files.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.