{"id":"CVE-2026-117510","kind":"vulnerability","aliases":["CVE-2026-117510"],"related":[],"title":"Dexbotic: path traversal in GR00T checkpoint loader lets attackers read files","description":"A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight_map causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Dexbotic 0.2.0 (and main as of the report) load_pretrained_gr00t joins each weight_map value from a checkpoint's model.safetensors.index.json onto the checkpoint dir with os.path.join, with no containment check. A crafted checkpoint with an absolute or ../ shard path makes the loader open safetensors files elsewhere on disk and write their tensors into the model, silently, so the policy can be poisoned. The main impact is integrity. Confidentiality impact is low: an error oracle tells whether a path exists, and tensors can leak if the poisoned model is later published. A public PoC exists and the project has not responded.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dexbotic","fixed":[],"affected":"<= 0.2.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","dexbotic","ml-models","python","robotics","self-hosted","untrusted-checkpoint"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- pip show dexbotic: 0.2.0 or earlier (also current main, commit 5b22b19) is affected.\n- Check whether your code calls load_pretrained_gr00t (dexbotic/model/gr00tsonic/gr00tsonic_arch.py, around lines 363-377) on a GR00T checkpoint you did not produce (hub download, mirror, shared archive).\n- Inspect the checkpoint's model.safetensors.index.json: any weight_map value that is an absolute path or contains '..' is malicious.","fix":"No fixed release exists and the maintainers have not responded (issue #103 open). Until a patch ships, only load GR00T checkpoints from sources you trust, and reject any index whose weight_map values are absolute or escape the checkpoint dir. The reporter suggests resolving each shard path and raising unless it is inside the checkpoint dir (Path.resolve().is_relative_to). Unverified: no vendor patch.","status":"open","published_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:13+00:00","updated_at":"2026-10-27T16:35:31+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T16:34:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Dexbotic: path traversal in GR00T checkpoint loader lets attackers read files","impact":"medium","summary":"Dexmal Dexbotic up to 0.2.0 has a path traversal flaw in the load_pretrained_gr00t function, where the weight_map argument is not sanitized. A remote attacker who can supply that argument can make the loader reach files outside the intended checkpoint directory.","category":"ai-tooling","nicknames":[],"who_cares":["python","robotics","ml-models","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads arbitrary files on the server running the loader","analyst_note":"Confirm whether a fixed version exists and whether weight_map is reachable from remote input; the exploit is public and the project has not responded, so check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-117510 for updates.","how_to_check":"- Check the installed Dexbotic version against `0.2.0` (e.g. `pip show dexbotic`)\n- Search the codebase for calls to `load_pretrained_gr00t` in `dexbotic/model/gr00tsonic/gr00tsonic_arch.py` and check whether `weight_map` comes from user input","needs_analyst":true,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Teams that run Dexbotic 0.2.0 or earlier and pass a weight_map value that can be influenced from outside, such as a request field or an uploaded config, are exposed. Projects that load only fixed, trusted checkpoints with hardcoded paths are less exposed. The sources do not say whether a patch exists, and the project has not responded to the report.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3379,"output_tokens":648,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version exists and whether weight_map is reachable from remote input; the exploit is public and the project has not responded, so check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-117510 for updates.","search":"'-117510':14A,17A '-2026':13A,16A '0.2.0':35B,145C 'absolut':70B 'affect':146C 'ai':20B 'ai-tool':19B 'argument':170C 'attack':9A,180C 'caus':173C 'check':64B 'checkpoint':6A,33B,52B,57B,67B,164C 'compon':162C 'confidenti':102B 'contain':63B 'craft':66B 'cve':12A,15A 'dexbot':1A,22B,34B,142C 'dexbotic':18A 'dexbotic/model/gr00tsonic/gr00tsonic_arch.py':159C 'dexmal':141C 'dir':58B 'disk':82B 'earli':199C 'elsewher':80B 'error':107B 'exist':113B,128B 'exploit':177C,184C 'file':11A,79B,158C 'flaw':136C 'found':139C 'function':152C 'gr00t':5A,44B,155C 'gr00tsonic':163C 'host':30B 'impact':99B,103B 'inform':195C 'integr':101B 'issu':202C 'join':45B 'later':123B 'leak':117B 'let':8A 'load':42B,153C 'loader':7A,76B,165C 'low':105B 'main':37B,98B 'make':74B 'manipul':167C 'map':48B,172C 'may':189C 'ml':24B 'ml-model':23B 'model':25B,89B,121B 'model.safetensors.index.json':54B 'onto':55B 'open':77B 'oracl':108B 'os.path.join':60B 'path':2A,73B,112B,174C 'poc':127B 'poison':96B,120B 'polici':93B 'possibl':182C 'pretrain':43B,154C 'problem':198C 'project':131B,193C 'public':126B 'publish':124B,187C 'python':26B 'read':10A 'remot':176C 'report':41B,203C 'respond':134B,207C 'robot':27B 'safetensor':78B 'self':29B 'self-host':28B 'shard':72B 'silent':90B 'tell':109B 'tensor':86B,115B 'tool':21B 'travers':3A,175C 'untrust':32B 'untrusted-checkpoint':31B 'use':191C 'valu':49B 'vulner':149C 'weight':47B,171C 'whether':110B 'write':84B 'yet':208C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Dexbotic 0.2.0 or earlier and pass a weight_map value that can be influenced from outside, such as a request field or an uploaded config, are exposed. Projects that load only fixed, trusted checkpoints with hardcoded paths are less exposed. The sources do not say whether a patch exists, and the project has not responded to the report.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-117510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117510","severity":null,"published_at":"2026-10-27T16:17:30+00:00","modified_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117510:882","url":null,"severity":null,"published_at":"2026-10-27T16:35:31+00:00","modified_at":"2026-10-27T16:35:31+00:00","first_seen_at":"2026-10-27T16:35:31+00:00","fetched_at":"2026-10-27T16:35:31+00:00","note":"Read reporter's issue #103 (PoC) and VulDB. Not a remote file-read: weight_map comes from the checkpoint's model.safetensors.index.json, so exposure needs loading an untrusted GR00T checkpoint; absolute/.. shard paths get opened and their tensors loaded into the model (weight poisoning, small oracle leak). No fix or maintainer reply as of issue 2026-10-11; main HEAD 5b22b19 still vulnerable. No exploitation reports seen; social search not run. Nothing marked verified (no vendor source)."}],"documents":[{"id":6982,"url":"https://github.com/Dexmal/dexbotic/issues/103","title":"Dexbotic issue #103: Path traversal in load_pretrained_gr00t (reporter 3em0, with PoC)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":6983,"url":"https://vuldb.com/vuln/427076","title":"VulDB VDB-427076","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}