This might be a false positive, but eval/requirements.txt around line 22 looked worth a second pair of eyes.
CRITICAL severity: Remote Code Execution in PyTorch (CVE-2025-32434). The project pins torch==2.2.0 in eval/requirements.txt (line 22), which is affected by a deserialization flaw where loading a crafted model checkpoint via torch.load() — even with weights_only=True, the historically 'safe' loading mode — allows arbitrary code execution on the host. Impact: any workflow that loads model weights from untrusted or semi-trusted sources (user uploads, public model hubs, shared artifacts, poisoned CI caches) becomes an RCE vector, potentially leading to full server compromise, credential/secret theft, and tampering with models or training data. Risk is rated CRITICAL because exploitation requires only delivering a malicious checkpoint file and it defeats the standard weights_only=True mitigation, so no code changes in the consuming application are needed for an attacker. Remediation: upgrade torch to >= 2.6.0 (patched version), regenerate any lock files, re-run the evaluation pipeline to confirm compatibility (including CUDA/torchvision matching versions), and review torch.load call sites to ensure only trusted artifacts are loaded going forward.
Something like this might fix it:
--- a/eval/requirements.txt
+++ b/eval/requirements.txt
@@ -22 +22 @@
-torch==2.2.0
+torch==2.6.0
# Notes:
# 1. If using a range-style pin, use: torch>=2.6.0
# 2. Regenerate lock files (e.g., poetry lock / pip-compile) and re-install:
# pip install --upgrade torch==2.6.0
# 3. Verify GPU/CUDA compatibility for the new version and update
# torchvision/torchaudio pins to matching 2.6.0-series releases if present.
For reference: rule CVE-2025-32434. Rated critical.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
eval/requirements.txtaround line 22 looked worth a second pair of eyes.CRITICAL severity: Remote Code Execution in PyTorch (CVE-2025-32434). The project pins torch==2.2.0 in eval/requirements.txt (line 22), which is affected by a deserialization flaw where loading a crafted model checkpoint via torch.load() — even with weights_only=True, the historically 'safe' loading mode — allows arbitrary code execution on the host. Impact: any workflow that loads model weights from untrusted or semi-trusted sources (user uploads, public model hubs, shared artifacts, poisoned CI caches) becomes an RCE vector, potentially leading to full server compromise, credential/secret theft, and tampering with models or training data. Risk is rated CRITICAL because exploitation requires only delivering a malicious checkpoint file and it defeats the standard weights_only=True mitigation, so no code changes in the consuming application are needed for an attacker. Remediation: upgrade torch to >= 2.6.0 (patched version), regenerate any lock files, re-run the evaluation pipeline to confirm compatibility (including CUDA/torchvision matching versions), and review torch.load call sites to ensure only trusted artifacts are loaded going forward.
Something like this might fix it:
For reference: rule
CVE-2025-32434. Rated critical.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.