CVE-2026-31218: The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370

A vulnerability in the optimate project's _load_model() function allows attackers to run arbitrary code on a victim's computer by providing a malicious model file. The problem occurs because the function uses torch.load() without the weights_only=True parameter, which means it can deserialize (convert data back into Python objects) any Python code hidden in a .pt file, not just safe model weights.