Live › vulnerability › CVE-2026-113743
Go to dashboardThe function load_hf_state_dict_filtered in tt-metal's tt_transformers checkpoint loader accepts a weight_map argument that is not sanitised, so a crafted value can traverse outside the intended directory. An attacker can use this to reach files the loading process can read on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run tt-metal up to 0.80.0 and load Hugging Face style checkpoints through the tt_transformers loader, where the weight_map value can be influenced by someone outside the team. Teams on later versions or not using this loader can skip it; the sources do not say whether the weight_map value is ever attacker-controlled in default setups.
No product ranges from the sources yet.
0.80.0; versions up to and including 0.80.0 are affected.models/tt_transformers/tt/load_checkpoints.py and the function load_hf_state_dict_filtered in your deployment.0.81.0-dev20261016 or later, which the sources state fixes this issue (patch 4851ccf347f6903c3d819eed60705600386e52c3).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-113743")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.