PyTorch Model File ACE via Pickle Deserialization PoC

Vulnerability

Arbitrary Code Execution via pickle deserialization in torch.load() (CWE-502)

Files

poc_torchsave.pt — Malicious .pt file, executes code on torch.load()
poc_evil_statedict.pt — Malicious state_dict with embedded payload
benign_model.pt — Clean model for comparison
benign_torchscript.pt — Clean TorchScript model

How to reproduce

import torch
# WARNING: This executes arbitrary code
model = torch.load('poc_torchsave.pt', weights_only=False)
# Creates pwned.txt as proof of execution

Impact

Any application loading untrusted .pt files with weights_only=False gets arbitrary code execution.

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support