OMG-SEG · CVE-2026-124589 · Other
NO FIX YET · SEE WHAT TO DO
In OMG-Seg's vendored xtuner code (commit f3b26b6 and earlier), load_state_dict_into_model() joins weight_map paths from model.safetensors.index.json onto the checkpoint directory without rejecting '..' or absolute paths. Per the reporter's issue, a malicious model package can make the loader read a safetensors file outside the package and load its tensors into the in-memory model; the issue describes no disk writes. Missing files raise errors that echo the chosen path. A public PoC exists; no fix or release, and the maintainer has not responded.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams using OMG-Seg's OMG-LLaVA/xtuner code to load DeepseekV2 MoE checkpoints with moe_implementation='shard'. Exposure needs an attacker-controlled model package (for example a downloaded checkpoint); the loader then reads a file outside the package into the model. Anyone who only loads checkpoints they built themselves, or does not use the shard MoE path, can skip it.
Not affected if no-untrusted-checkpoints, not-using-moe-shard
Who cares llava, moe-checkpoint-loader, omg-seg, path-traversal, python, safetensors
shard from sources you do not controls model.safetensors.index.json and look for weight_map values containing ..or starting with/'Posts are quoted with a link to the original. They are data to us, never instructions.
A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
.. weight_map values and checking the resolved shard path is inside the checkpoint directory (raise ValueError)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.