pytorch-safe-globals-thread-leak-poc-20260709

PyTorch safe_globals cross-thread weights_only=True bypass PoC

This repository demonstrates a concurrency-scoping bug in PyTorch's public torch.serialization.safe_globals(...) API.

What this PoC shows:

• torch.load(..., weights_only=True) blocks an attacker-controlled custom class by default.
• While a different thread holds with torch.serialization.safe_globals([DangerousState]): open for a trusted load, an unrelated thread can load the same class without opting into safe_globals.
• The attacker-controlled class reaches __setstate__ during deserialization, proving code execution in that shared worker process.

What this PoC does not show:

• a bypass in single-threaded workflows
• a bug in add_safe_globals(), which is already an explicit process-wide opt-in
• a claim that every .pt load path is unsafe by default

Verified runtime:

• official torch-2.13.0+cpu wheel

Run:

python3 poc_safe_globals_thread_leak.py