safetensors-torchload-rce-poc

Safetensors convert.py torch.load() RCE PoC

Vulnerability

convert.py uses torch.load() without weights_only=True, allowing arbitrary code execution when converting malicious .pt files.

Affected

• PyTorch < 2.6 (default weights_only=False)
• PyTorch 2.6+ if converter adds weights_only=False for compatibility

PoC

malicious_model.pt contains a pickle payload that executes touch /tmp/safetensors_rce_poc when loaded.

Reproduction

# Using safetensors converter
python convert.py path/to/malicious_model.pt

# Direct test
python -c "import torch; torch.load('malicious_model.pt', weights_only=False)"
ls /tmp/safetensors_rce_poc  # File created = RCE

Impact

• RCE when users convert untrusted .pt files
• Warning prompt can be bypassed with -y flag
• No technical mitigation despite weights_only=True being available

Fix

# Add weights_only=True
loaded = torch.load(pt_filename, map_location="cpu", weights_only=True)