Is torch safe ? 13 known vulnerabilities, worst severity CRITICAL.
// reach 22 direct dependencies
5 carry known advisories, worst CRITICAL
805 packages depend on it
an advisory here reaches each of them
// ai models 3,708 published models carry an advisory from this package
13 pin a version the advisory is confirmed against; the rest declare it without a version.
3,721 published models
37 declared · 581 observed · 3612 inferred
3721 published AI models are associated with this package: 37 name it in a requirements or pyproject file, 581 load it or import it directly, and 3612 are inferred from the runtime stack their declared library pulls in. Only 31 state a version requirement, so this is not a count of affected models.
cvss CVSS v4.0 base score out of 10
epss chance of exploitation in 30 days, 84th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-53q9-r3pm-6pq6, the advisory selected below
// 13 advisories GHSA-53q9-r3pm-6pq6 I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE. CRIT GHSA-47fc-vmwq-366v In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. The fix for this issue is available in version 1.13.1. There is a release checker in issue #89855. CRIT GHSA-63cw-57p8-fm3p A vulnerability in PyTorch's weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(..., weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. HIGH GHSA-5pcm-hx3q-hm94 PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. HIGH GHSA-pg7h-5qx3-wjr3 Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp. HIGH GHSA-887c-mr87-cxwp A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It i MODE GHSA-vgrw-7cvw-pwgx A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. MODE GHSA-f4hp-rmr7-r7v8 A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. MODE GHSA-rrmf-rvhw-rf47 A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. LOW GHSA-qfhq-4f3w-5fph A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. LOW Show all 13 advisories // description I found a Remote Command Execution (RCE) vulnerability in PyTorch. When loading model using torch.load with weights_only=True, it can still achieve RCE.
// background knowledge https://github.com/pytorch/pytorch/security As you can see, the PyTorch official documentation considers using torch.load() with weights_only=True to be safe. Since everyone knows that weights_only=False is unsafe, so they will use the weights_only=True to mitigate the seucirty issue. But now, I just proved that even if you use weights_only=True, it can still achieve RCE.
// credit This vulnerability was found by Ji'an Zhou.
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attack vector Network
Attack complexity Low
Attack requirements None
Privileges required None
User interaction None
Confidentiality (vulnerable system) High
Integrity (vulnerable system) High
Availability (vulnerable system) High
Confidentiality (subsequent systems) None
Integrity (subsequent systems) None
Availability (subsequent systems) None Checked 2026-11-06 at 21:15 UTC. The most recent advisory here was published 2026-01-27. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page