ACVE-2026-0313

In the wild

demonstrated · research

Description

What

The PyTorch advisory describes a bypass of the weights-only deserialization boundary in releases before 2.10.0. The safety setting was introduced to reduce Pickle execution, but a vulnerable loader can still reach dangerous behavior through crafted model content. This record covers the loader side; it does not assert that every Pickle file is malicious.

Which configuration is exposed

The configuration is exposed when a model is loaded with weightsOnly false or with an older torch implementation whose effective protection can be bypassed. A model cache containing Pickle-bearing weights increases the consequence. The lock records policy intent but does not currently record the torch distribution version.

How ACVE detects it

ACVE matches some models where loaderPolicy.weightsOnly is explicitly false. This avoids matching a model merely because it exists, while still identifying a direct unsafe policy. A missing policy remains unknown. The PyPI affected range carries the exact CVE boundary for environments that can supply package versions separately.

Fix

Upgrade torch to 2.10.0 or later, set weightsOnly true, and prefer safetensors. Delete untrusted Pickle files already staged in the cache. Keep model loading isolated from credentials and network access while validating old artifacts, because the configuration signal is not a runtime proof of exploitability.

Grounding needed

The GitHub advisory and PyTorch release note should confirm the bypass mechanics and fixed boundary. A future lock enrichment should add the torch version; until then the matcher is deliberately policy-focused and may require review.

This record is limited to the condition named in the public source: PyTorch weights-only protection can be bypassed before 2.10.0. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  loaderPolicy.weightsOnly eq false

Fix

Upgrade torch to 2.10.0 or later and keep weights-only loading enabled.

• Upgrade pypi:torch to 2.10.0. Use the fixed release.
• Reconfigure loaderPolicy.weightsOnly to true. Keep executable Pickle paths disabled.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

ADVISORY

• https://github.com/advisories/GHSA-63cw-57p8-fm3p

FIX

• https://pytorch.org/blog/pytorch2-6/