CVE-2026-31218 Deserialization in n/a
Remote attackers can execute arbitrary code by providing a malicious model file to the optimate project due to insecure deserialization in torch.load.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31218?
CVE-2026-31218 is a high-severity unsafe deserialization vulnerability in n/a, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable to insecure deserialization (CWE-502). When loading a model state dictionary from a state_dict.pt file via torch.load(), the function does not enable the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects through the Pickle module. A remote attacker can exploit this by providing a maliciously crafted state_dict.pt file within a directory specified via the --model argument, leading to arbitrary code execution during the deserialization process on the victim's system.
Weakness: CWE-502
Which versions are affected by CVE-2026-31218?
How do I fix CVE-2026-31218?
No fix has been published for CVE-2026-31218 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-31218 being exploited?
There is no known exploitation of CVE-2026-31218 in the wild and no public exploit code.
Sources
Also known as GHSA-q2mf-qjjq-ghcc.