CVE-2026-31219 — Unsafe torch.load of single model file path in optimate neural_magic_training.py

MITRE service request: 1987825

Status: RESERVED (pending a qualifying public reference per CNA Rules §5.3).

Official CVE description

The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable to insecure deserialization (CWE-502). When a user provides a single model file path (e.g., .pt or .pth) via the –model command-line argument, the function loads the file using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects through the Pickle module. A remote attacker can exploit this by providing a maliciously crafted model file, leading to arbitrary code execution during deserialization on the victim’s system.

Summary

Supplying --model /path/to/evil.pt hits the same insecure torch.load path: full pickle gadget execution on read. Attackers only need to convince the victim to download and point the CLI at a weaponized artifact.

Affected product and versions

• Product: nebuly-ai/optimate.
• Known vulnerable commit (coordination record): a6d302f912b481c94370811af6b11402f51d377f.

Technical details

• Input: File path ending in .pt / .pth passed via -model.
• Sink: torch.load without weights_only=True.
• Exploitability: High in ML supply chains (HuggingFace mirrors, email attachments).
• Impact: Arbitrary code execution at deserialization time.

Risk

High for interactive researchers pulling third-party checkpoints.

Remediation / workaround

• Load only signed checkpoints; upgrade PyTorch semantics where possible.
• Add integrity verification before torch.load.