CVE-2026-31214 - Vulnerability Analysis

Overview

ml-engineering torch-checkpoint-shrink.py script contains an insecure deserialization caused by use of torch.load() without weights_only=True, letting remote attackers execute arbitrary code via crafted checkpoint files, exploit requires malicious checkpoint file.

Severity & Score

Impact

Remote attackers can execute arbitrary code in the context of the user running the script, potentially leading to full system compromise.

Mitigation

Update the script to use torch.load() with weights_only=True or apply security patches to restrict deserialization.

References

• https://github.com/stas00/ml-engineering/blob/master/training/checkpoints/torch-checkpoint-shrink.py#L57
• https://www.notion.so/CVE-2026-31214-35d1e1393188813fa40eef73c174cee5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner