Unsafe deserializer on remote artifact

unsafe-deserializer-on-remote-artifact

Severity

critical

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM03:2025 — Supply Chain

OWASP ASI

ASI05:2026 (secondary ASI04:2026)

Family

LLM03 — Supply Chain

Red-team vectors

Sandbox Escape / RCE

Description

A code-executing deserializer is applied to a remote-derived model artifact: pickle.load, torch.load(…) with the unsafe default (no weights_only=True), joblib.load, or yaml.load without SafeLoader. These deserializers execute arbitrary code on load, so a tampered remote artifact is a direct remote-code-execution vector.

The detector fires only when the file also fetches the artifact from a remote source (a download/HTTP signal), keeping the false-positive surface low.

Examples

path = hf_hub_download(repo_id="acme/model", filename="model.bin")
weights = torch.load(path)          (1)

1	`torch.load` without `weights_only=True` on a remote-derived artifact — flagged critical.

torch.load(local_path, weights_only=True) and safetensors.torch.load_file(…) produce no finding.

Mitigation / Fix

Use a safe loader: torch.load(…, weights_only=True), safetensors.load_file(…), yaml.safe_load(…).
Verify the artifact hash / signature before loading, and pull only from trusted sources.