AI Sec Watch

The Adversarial Robustness Toolbox (ART) version 1.20.1 and earlier has a remote code execution (RCE, where an attacker can run commands on a system they don't own) vulnerability in its Kubeflow component. The vulnerability exists because the robustness evaluation function uses eval() (a function that executes text as Python code) without checking user input, allowing an attacker to submit malicious Python code that runs on the system when the evaluation function processes it.

The snorkel library (a tool for machine learning data labeling) versions up to 0.10.0 has a security flaw in its MultitaskClassifier.load() method that allows arbitrary code execution (running any commands an attacker wants on your computer). The problem occurs because the method uses torch.load() without the weights_only=True security setting, which means it can deserialize (reconstruct) malicious Python objects from model files that an attacker provides.

The snorkel library (a machine learning tool for data labeling) versions up to 0.10.0 has a critical vulnerability in its BaseLabeler.load() method, which uses pickle.load() (a Python function that converts saved data back into usable objects) on user files without checking if they're safe. An attacker can create a malicious file that executes harmful code on a victim's computer when the file is loaded.

The snorkel library up to version 0.10.0 has a vulnerability in its Trainer.load() method that unsafely deserializes (converts saved data back into objects) model files using torch.load() without security protections. An attacker can craft a malicious model file that executes arbitrary code (RCE, remote code execution) when a user loads it with this method.

PyTorch-Lightning versions 2.6.0 and earlier have a vulnerability in their checkpoint loading function that allows attackers to execute arbitrary code (running any commands they want on a victim's computer) by providing a malicious checkpoint file. The problem occurs because the code uses torch.load() without the weights_only=True parameter, which means it can deserialize (reconstruct) any Python object, including dangerous ones hidden in the checkpoint file.

A bug in the optimate project's neural_magic_training.py script allows attackers to run arbitrary code on a victim's computer by providing a malicious model file. The vulnerability exists because the _load_model() function uses torch.load() without the weights_only=True parameter, which means it can deserialize (reconstruct) any Python object from a file, including malicious ones hidden in .pt or .pth files.

A vulnerability in the optimate project's _load_model() function allows attackers to run arbitrary code on a victim's computer by providing a malicious model file. The problem occurs because the function uses torch.load() without the weights_only=True parameter, which means it can deserialize (convert data back into Python objects) any Python code hidden in a .pt file, not just safe model weights.

A script called torch-checkpoint-shrink.py in the ml-engineering project has an insecure deserialization vulnerability (CWE-502, a weakness where untrusted data is converted back into objects without proper validation). The script uses torch.load() to read PyTorch checkpoint files (.pt) without the weights_only=True security setting, which allows attackers to execute arbitrary code (run any commands they want) by providing a malicious checkpoint file. An attacker can exploit this remotely by tricking a user into loading a specially crafted file.

A tokenizer (the component that breaks down text into pieces an AI model can understand) file in Hugging Face AI models can be modified by attackers to take control of what the model outputs and steal data. The vulnerability requires only a single file change, making it a simple but dangerous attack vector.