Live › vulnerability › CVE-2026-112304
Go to dashboarddocTR's load_pretrained_params() calls torch.load without weights_only=True, so it unpickles checkpoint files. A crafted checkpoint, supplied locally or fetched from a URL, can run Python code with the privileges of the process that loads it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that load docTR pretrained weights from a file path or URL that someone else can influence, such as a user upload or a shared bucket, are exposed. Applications that only load the official pretrained weights from a fixed, trusted location are much less exposed. Code that never calls load_pretrained_params can skip it.
No product ranges from the sources yet.
pip show python-doctr and check whether the version is 1.1.0 or earlier.pip show torch and check whether the version is below 2.6.load_pretrained_params or torch.load that take checkpoints from users or remote URLs.1.1.0 once one is available; the sources do not name a fixed version.2.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-112304")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.