---
id: "CVE-2026-117510"
kind: "vulnerability"
aliases: ["CVE-2026-117510"]
title: "Dexbotic: path traversal in GR00T checkpoint loader lets attackers read files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "dexbotic", "fixed": [], "affected": "<= 0.2.0", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "dexbotic", "ml-models", "python", "robotics", "self-hosted", "untrusted-checkpoint"]
not_affected_if: ["default-config", "trusted-input-only"]
published_at: "2026-10-27T16:17:30+00:00"
first_seen_at: "2026-10-27T16:33:07+00:00"
updated_at: "2026-10-27T16:35:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117510", "first_seen_at": "2026-10-27T16:33:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T16:35:31+00:00"}]
---

# Dexbotic: path traversal in GR00T checkpoint loader lets attackers read files

Dexbotic 0.2.0 (and main as of the report) load_pretrained_gr00t joins each weight_map value from a checkpoint's model.safetensors.index.json onto the checkpoint dir with os.path.join, with no containment check. A crafted checkpoint with an absolute or ../ shard path makes the loader open safetensors files elsewhere on disk and write their tensors into the model, silently, so the policy can be poisoned. The main impact is integrity. Confidentiality impact is low: an error oracle tells whether a path exists, and tensors can leak if the poisoned model is later published. A public PoC exists and the project has not responded.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:dexbotic affected <= 0.2.0 fixed ?

## How to check

- pip show dexbotic: 0.2.0 or earlier (also current main, commit 5b22b19) is affected.
- Check whether your code calls load_pretrained_gr00t (dexbotic/model/gr00tsonic/gr00tsonic_arch.py, around lines 363-377) on a GR00T checkpoint you did not produce (hub download, mirror, shared archive).
- Inspect the checkpoint's model.safetensors.index.json: any weight_map value that is an absolute path or contains '..' is malicious.

## Fix

No fixed release exists and the maintainers have not responded (issue #103 open). Until a patch ships, only load GR00T checkpoints from sources you trust, and reject any index whose weight_map values are absolute or escape the checkpoint dir. The reporter suggests resolving each shard path and raising unless it is inside the checkpoint dir (Path.resolve().is_relative_to). Unverified: no vendor patch.

## Timeline

- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117510
- 2026-10-27T16:35:31+00:00 analyst — Read reporter's issue #103 (PoC) and VulDB. Not a remote file-read: weight_map comes from the checkpoint's model.safetensors.index.json, so exposure needs loading an untrusted GR00T checkpoint; absolute/.. shard paths get opened and their tensors loaded into the model (weight poisoning, small oracle leak). No fix or maintainer reply as of issue 2026-10-11; main HEAD 5b22b19 still vulnerable. No exploitation reports seen; social search not run. Nothing marked verified (no vendor source).

## Documents

- [describes] VulDB VDB-427076 https://vuldb.com/vuln/427076
- [poc] Dexbotic issue #103: Path traversal in load_pretrained_gr00t (reporter 3em0, with PoC) https://github.com/Dexmal/dexbotic/issues/103

## From the sources

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight_map causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_