T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:33
- Finding
- Unsafe PyTorch Checkpoint Deserialization Guidance## Vulnerability Details **File Location**: `SKILL.md`, lines 33-34 **Vulnerability Type**: Unsafe deserialization **Risk Level**: High **Vulnerable code snippet:** ```python - Loading: create model first, then `model.load_state_dict(torch.load(path))` - `map_location` for cross-device — `torch.load(path, map_location='cpu')` if saved on GPU ``` ### Technical Analysis The checkpoint-loading examples call `torch.load()` without explicitly enabling restricted weight-only deserialization or requiring the checkpoint to originate from a trusted source. PyTorch checkpoint files can use pickle-based serialization. On PyTorch versions or configurations that permit unrestricted pickle loading, deserializing a malicious checkpoint can invoke attacker-controlled object reconstruction logic and execute arbitrary Python code. `map_location='cpu'` only controls where tensors are loaded; it does not make an untrusted serialized object safe. Although newer PyTorch releases may default to restricted weight-only loading, relying on a version-dependent default is not a sufficient security boundary. ### Attack Path 1. An attacker creates a malicious PyTorch checkpoint containing a crafted pickle payload. 2. The attacker supplies the file through a model repository, download link, shared storage location, or replacement of an expected local checkpoint. 3. A user follows the Skill's documented loading pattern and passes the attacker-controlled path to `torch.load()`. 4. In a PyTorch environment permitting unrestricted pickle deserialization, the crafted reconstruction routine runs while the checkpoint is loaded. 5. The payload executes with the privileges of the Python process before or during the subsequent `load_state_dict()` operation. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the account running the Python process. The attacker could read or modify files available to that account, acces ...[truncated 362 chars]
- Remediation
- ## Remediation Suggestions - Explicitly request restricted weight-only loading: ```python state_dict = torch.load( path, map_location="cpu", weights_only=True, ) model.load_state_dict(state_dict) ``` - Require checkpoints to come from trusted and authenticated sources. - Verify downloaded checkpoints against a securely distributed cryptographic hash or signature. - Pin a maintained PyTorch version that supports `weights_only=True`; do not rely on version-dependent defaults. - Validate that the loaded object has the expected state-dictionary structure and reject unexpected object types or keys. - If a legacy checkpoint requires unrestricted deserialization, convert it only in an isolated, disposable environment without credentials, sensitive files, or unnecessary network access. - Add an explicit warning that `map_location` does not mitigate pickle deserialization risks and that untrusted checkpoints must never be loaded with unrestricted pickle support.