Summary
docTR through version 1.1.0 uses torch.load without restricting checkpoint deserialization, allowing controlled checkpoint data to carry malicious pickle content. An attacker who can supply a local or URL-based checkpoint may execute Python code with the privileges of the loading process, particularly when using affected PyTorch releases.
docTR through version 1.1.0 uses torch.load without restricting checkpoint deserialization, allowing controlled checkpoint data to carry malicious pickle content. An attacker who can supply a local or URL-based checkpoint may execute Python code with the privileges of the loading process, particularly when using affected PyTorch releases.
Affected context
The vulnerability occurs in docTR's load_pretrained_params() routine when it loads model checkpoints through an unrestricted PyTorch deserialization path. Risk is present when an application accepts checkpoints from local locations or remote URLs that are not fully trusted, and when the underlying PyTorch behavior permits pickle-based object reconstruction.
The vulnerability occurs in docTR's load_pretrained_params() routine when it loads model checkpoints through an unrestricted PyTorch deserialization path. Risk is present when an application accepts checkpoints from local locations or remote URLs that are not fully trusted, and when the underlying PyTorch behavior permits pickle-based object reconstruction.
Exploit preconditions
- Attack surface: Model checkpoint loading through docTR's pretrained-parameter functionality
- Required access: Ability to place, select, or provide a local or URL-supplied checkpoint
- Trigger point: Invocation of
load_pretrained_params()and subsequenttorch.loadprocessing - Why exploitation is possible: The checkpoint can contain pickle instructions that are processed during deserialization with the loader process's permissions
- Attack surface: Model checkpoint loading through docTR's pretrained-parameter functionality
- Required access: Ability to place, select, or provide a local or URL-supplied checkpoint
- Trigger point: Invocation of
load_pretrained_params()and subsequenttorch.loadprocessing - Why exploitation is possible: The checkpoint can contain pickle instructions that are processed during deserialization with the loader process's permissions
Why this happens
The underlying bug is unsafe deserialization of attacker-influenced checkpoint data. Calling torch.load without a restricted weights-only mode allows pickle-backed object reconstruction, which can invoke code during loading rather than merely restoring model weights. This behavior maps to CWE-502: Deserialization of Untrusted Data, because serialized input is treated as trusted executable object data.
The underlying bug is unsafe deserialization of attacker-influenced checkpoint data. Calling torch.load without a restricted weights-only mode allows pickle-backed object reconstruction, which can invoke code during loading rather than merely restoring model weights. This behavior maps to CWE-502: Deserialization of Untrusted Data, because serialized input is treated as trusted executable object data.
Potential impact
- The attacker may execute arbitrary Python code in the loading process
- The application could be compromised with its existing privileges
- Local files, credentials, or environment data may be exposed
- A compromised process could be used for lateral movement or further attacks
- The attacker may execute arbitrary Python code in the loading process
- The application could be compromised with its existing privileges
- Local files, credentials, or environment data may be exposed
- A compromised process could be used for lateral movement or further attacks
General mitigation guidance
Mitigation generally focuses on eliminating unrestricted pickle deserialization and reducing trust in checkpoint sources.
Common defensive patterns include:
- Using a restricted, weights-only checkpoint loading mode where model compatibility permits
- Accepting checkpoints only from authenticated and integrity-verified sources
- Separating model download, validation, and loading into a constrained process
- Applying strict allowlists for supported checkpoint formats and locations
- Running model-loading workloads with least privilege and minimal filesystem and network access
- Treating externally supplied checkpoints as untrusted even when they use expected file extensions
Mitigation generally focuses on eliminating unrestricted pickle deserialization and reducing trust in checkpoint sources.
Common defensive patterns include:
- Using a restricted, weights-only checkpoint loading mode where model compatibility permits
- Accepting checkpoints only from authenticated and integrity-verified sources
- Separating model download, validation, and loading into a constrained process
- Applying strict allowlists for supported checkpoint formats and locations
- Running model-loading workloads with least privilege and minimal filesystem and network access
- Treating externally supplied checkpoints as untrusted even when they use expected file extensions
How teams detect issues like this
Detection approaches commonly include:
- Static analysis rules for
torch.loadcalls that omit restricted loading options - Code review checks for checkpoint paths or URLs derived from user-controlled input
- Dependency and policy scans covering unsafe serialization APIs
- Runtime monitoring for unexpected process execution, filesystem access, or outbound network activity during model loading
- CI enforcement requiring approved checkpoint formats and integrity validation before ingestion
Automated code review and security scanning tools can help identify unsafe deserialization patterns early.
Detection approaches commonly include:
- Static analysis rules for
torch.loadcalls that omit restricted loading options - Code review checks for checkpoint paths or URLs derived from user-controlled input
- Dependency and policy scans covering unsafe serialization APIs
- Runtime monitoring for unexpected process execution, filesystem access, or outbound network activity during model loading
- CI enforcement requiring approved checkpoint formats and integrity validation before ingestion
Automated code review and security scanning tools can help identify unsafe deserialization patterns early.
