{"id":"CVE-2026-112304","kind":"vulnerability","aliases":["CVE-2026-112304"],"related":[],"title":"docTR: unsafe checkpoint loading lets a malicious model file run code","description":"docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6.","summary":"docTR's load_pretrained_params() calls torch.load without weights_only=True, so it unpickles checkpoint files. A crafted checkpoint, supplied locally or fetched from a URL, can run Python code with the privileges of the process that loads it.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ml-pipelines","package","python","python-doctr","pytorch"],"not_affected_if":["fixed-trusted-checkpoints","no-load_pretrained_params-calls"],"how_to_check":"- Run `pip show python-doctr` and check whether the version is 1.1.0 or earlier.\n- Run `pip show torch` and check whether the version is below `2.6`.\n- Search your code for calls to `load_pretrained_params` or `torch.load` that take checkpoints from users or remote URLs.","fix":"- Upgrade python-doctr to a release later than `1.1.0` once one is available; the sources do not name a fixed version.\n- Upgrade torch to `2.6` or later.\n- Only load checkpoints from trusted, locally verified sources until patched.","status":"open","published_at":"2026-10-19T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:10:53+00:00","updated_at":"2026-10-25T03:10:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:10:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade python-doctr to a release later than `1.1.0` once one is available; the sources do not name a fixed version.\n- Upgrade torch to `2.6` or later.\n- Only load checkpoints from trusted, locally verified sources until patched.","reach":"network","title":"docTR: unsafe checkpoint loading lets a malicious model file run code","impact":"high","summary":"docTR's load_pretrained_params() calls torch.load without weights_only=True, so it unpickles checkpoint files. A crafted checkpoint, supplied locally or fetched from a URL, can run Python code with the privileges of the process that loads it.","category":"package","nicknames":[],"who_cares":["python","python-doctr","ml-pipelines","pytorch"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary Python code as the loading process.","analyst_note":"Confirm the fixed python-doctr version and whether torch 2.6 alone mitigates; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112304 for the vendor advisory.","how_to_check":"- Run `pip show python-doctr` and check whether the version is 1.1.0 or earlier.\n- Run `pip show torch` and check whether the version is below `2.6`.\n- Search your code for calls to `load_pretrained_params` or `torch.load` that take checkpoints from users or remote URLs.","needs_analyst":true,"not_affected_if":["fixed-trusted-checkpoints","no-load_pretrained_params-calls"],"who_is_affected":"Teams that load docTR pretrained weights from a file path or URL that someone else can influence, such as a user upload or a shared bucket, are exposed. Applications that only load the official pretrained weights from a fixed, trusted location are much less exposed. Code that never calls load_pretrained_params can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":3336,"output_tokens":695,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112304':14A,17A '-2026':13A,16A '1.1.0':67C '2.6':116C 'attack':86C 'call':32B 'checkpoint':3A,41B,45B,79C,95C 'code':11A,56B,105C 'contain':68C 'control':88C 'craft':44B 'cve':12A,15A 'deseri':71C 'doctr':1A,25B,27B,65C 'emb':97C 'execut':103C 'fetch':49B 'file':9A,42B 'let':5A 'load':4A,29B,64B,74C,78C,108C 'local':47B,90C 'malici':7A,99C 'ml':19B 'ml-pipelin':18B 'model':8A 'packag':21B 'param':31B,76C 'payload':101C 'pickl':100C 'pipelin':20B 'pretrain':30B,75C 'privileg':59B,111C 'process':62B,109C 'python':22B,24B,55B,104C 'python-doctr':23B 'pytorch':26B 'releas':114C 'run':10A,54B 'suppli':46B,94C 'torch':113C 'torch.load':33B,81C 'true':37B,85C 'unpickl':40B 'unsaf':2A,70C 'url':52B,93C 'url-suppli':92C 'vulner':72C 'weight':35B,83C 'without':34B,82C","nicknames":[],"mitigations":[],"who_affected":"Teams that load docTR pretrained weights from a file path or URL that someone else can influence, such as a user upload or a shared bucket, are exposed. Applications that only load the official pretrained weights from a fixed, trusted location are much less exposed. Code that never calls load_pretrained_params can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112304","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112304","severity":null,"published_at":"2026-10-19T16:17:06+00:00","modified_at":"2026-10-22T04:17:32+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}