{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0313",
  "aliases": [
    "CVE-2026-24747",
    "GHSA-63cw-57p8-fm3p"
  ],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "PyTorch weights-only protection can be bypassed before 2.10.0",
  "details": "## What\n\nThe PyTorch advisory describes a bypass of the weights-only deserialization boundary in releases before 2.10.0. The safety setting was introduced to reduce Pickle execution, but a vulnerable loader can still reach dangerous behavior through crafted model content. This record covers the loader side; it does not assert that every Pickle file is malicious.\n\n## Which configuration is exposed\n\nThe configuration is exposed when a model is loaded with weightsOnly false or with an older torch implementation whose effective protection can be bypassed. A model cache containing Pickle-bearing weights increases the consequence. The lock records policy intent but does not currently record the torch distribution version.\n\n## How ACVE detects it\n\nACVE matches some models where loaderPolicy.weightsOnly is explicitly false. This avoids matching a model merely because it exists, while still identifying a direct unsafe policy. A missing policy remains unknown. The PyPI affected range carries the exact CVE boundary for environments that can supply package versions separately.\n\n## Fix\n\nUpgrade torch to 2.10.0 or later, set weightsOnly true, and prefer safetensors. Delete untrusted Pickle files already staged in the cache. Keep model loading isolated from credentials and network access while validating old artifacts, because the configuration signal is not a runtime proof of exploitability.\n\n## Grounding needed\n\nThe GitHub advisory and PyTorch release note should confirm the bypass mechanics and fixed boundary. A future lock enrichment should add the torch version; until then the matcher is deliberately policy-focused and may require review.\n\nThis record is limited to the condition named in the public source: PyTorch weights-only protection can be bypassed before 2.10.0. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "torch"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-63cw-57p8-fm3p"
    },
    {
      "type": "FIX",
      "url": "https://pytorch.org/blog/pytorch2-6/"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "command-injection",
        "config-autoload"
      ],
      "cwe": [
        "CWE-78"
      ],
      "exploitation": {
        "status": "demonstrated",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://github.com/advisories/GHSA-63cw-57p8-fm3p",
            "type": "research"
          }
        ],
        "kev": {
          "listed": false
        }
      },
      "cveBoundary": "cve-aliased",
      "matcher": {
        "some": "models",
        "where": {
          "field": "loaderPolicy.weightsOnly",
          "op": "eq",
          "value": false
        }
      },
      "fix": {
        "summary": "Upgrade torch to 2.10.0 or later and keep weights-only loading enabled.",
        "actions": [
          {
            "type": "upgrade",
            "target": "pypi:torch",
            "to": "2.10.0",
            "why": "Use the fixed release."
          },
          {
            "type": "reconfigure",
            "target": "loaderPolicy.weightsOnly",
            "to": "true",
            "why": "Keep executable Pickle paths disabled."
          }
        ]
      }
    }
  }
}