{"data":{"id":"1062e9af-fd88-4569-a72f-47c30f592af1","title":"CVE-2026-123974: In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a local user swap the model…","summary":"A predictable extraction directory in /tmp in all versions of PyTorch's TorchServe lets a local user swap the model handler. The attacker can then run code as the TorchServe service account, which is a local privilege escalation.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-123974","publishedAt":"2026-11-06T20:17:20.633Z","cveId":"CVE-2026-123974","cweIds":["CWE-379"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Meta"],"affectedVendorsRaw":["PyTorch TorchServe"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TorchServe local privilege escalation via predictable /tmp extraction directory","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-07T00:12:12.704Z","kevDateAdded":null,"advisoryAliases":["GHSA-g2fw-m3ph-hqcq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-07T00:12:16.587Z","patchAvailable":null,"disclosureDate":"2026-11-06T20:17:20.633Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}