{"id":"CVE-2026-124589","kind":"vulnerability","aliases":["CVE-2026-124589"],"related":[],"title":"OMG-Seg: a crafted checkpoint index can make the MoE shard loader read files outside the model folder","description":"A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"In OMG-Seg's vendored xtuner code (commit f3b26b6 and earlier), load_state_dict_into_model() joins weight_map paths from model.safetensors.index.json onto the checkpoint directory without rejecting '..' or absolute paths. Per the reporter's issue, a malicious model package can make the loader read a safetensors file outside the package and load its tensors into the in-memory model; the issue describes no disk writes. Missing files raise errors that echo the chosen path. A public PoC exists; no fix or release, and the maintainer has not responded.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OMG-Seg","fixed":[],"affected":"<= f3b26b609bae919760cd3ccf09c36179bb8624a0 (no versioned releases)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["llava","moe-checkpoint-loader","omg-seg","other","path-traversal","python","safetensors"],"not_affected_if":["no-untrusted-checkpoints","not-using-moe-shard"],"how_to_check":"You are exposed if you use OMG-Seg at or before commit f3b26b609bae919760cd3ccf09c36179bb8624a0 and load DeepseekV2 MoE checkpoints with moe_implementation='shard' from sources you do not control. Open each package's model.safetensors.index.json and look for weight_map values containing '..' or starting with '/'. Check omg_llava/xtuner/utils/handle_moe_load_and_save.py for a containment check before os.path.join.","fix":"No fix or release as of 2026-11-09; the project does not use versioning and issue #78 is open with no maintainer response. Reporter suggests rejecting absolute/'..' weight_map values and checking the resolved shard path is inside the checkpoint directory (raise ValueError). Interim: load only MoE shard checkpoints whose index you have checked by hand, and process untrusted packages in an isolated environment.","status":"open","published_at":"2026-11-09T10:17:09+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:06+00:00","updated_at":"2026-11-09T10:27:11+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-09T10:26:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OMG-Seg: crafted checkpoint weight_map enables remote path traversal","impact":"high","summary":"OMG-Seg's MoE shard checkpoint loader does not validate the weight_map argument, so a crafted value can traverse file paths. A remote attacker can use the publicly available exploit to reach files outside the intended checkpoint directory.","audience":"developers","category":"other","nicknames":[],"who_cares":["omg-seg","llava","moe-checkpoint-loader","python"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"attacker reads or writes files outside the checkpoint directory","analyst_note":"Check the NVD entry and the linked upstream issue for the exact exposure, whether the loader is reachable from a service, and whether any mitigation exists, since no fix or fixed version is stated.","how_to_check":"- unknown","plain_action":"","product_name":"OMG-Seg","needs_analyst":true,"not_affected_if":["no-untrusted-checkpoints"],"who_is_affected":"The flaw is in load_state_dict_into_model in omg_llava/xtuner/utils/handle_moe_load_and_save.py, which loads MoE sharded checkpoints. Teams that load checkpoints from untrusted sources through this code path are the ones to look at. The sources do not state which releases are affected because the project does not use versioning, and the maintainer has not responded to the early issue report.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4686,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the linked upstream issue for the exact exposure, whether the loader is reachable from a service, and whether any mitigation exists, since no fix or fixed version is stated.","search":"'-124589':22A,25A '-2026':21A,24A 'absolut':73B 'affect':148C,213C 'argument':173C 'attack':182C,201C 'avail':192C 'checkpoint':6A,32B,68B,166C 'chosen':118B 'code':50B 'commit':51B 'compon':163C 'could':197C 'craft':5A 'cve':20A,23A 'describ':107B 'dict':57B,153C 'directori':69B 'disk':109B 'earli':226C 'earlier':54B 'echo':116B 'error':114B 'execut':168C 'exist':123B 'exploit':188C 'f3b26b6':52B 'f3b26b609bae919760cd3ccf09c36179bb8624a0':146C 'file':15A,91B,112B,158C 'fix':125B 'folder':19A 'function':150C 'identifi':138C 'in-memori':101B 'index':7A 'inform':211C,222C 'issu':79B,106B,229C 'join':60B 'launch':185C 'lead':177C 'llava':29B 'llava/xtuner/utils/handle_moe_load_and_save.py':160C 'load':55B,96B,151C 'loader':13A,33B,87B,167C 'lxtgh':140C 'made':191C 'maintain':130B 'make':9A,85B 'malici':81B 'manipul':170C 'map':62B,175C 'memori':103B 'miss':111B 'model':18A,59B,82B,104B,155C 'model.safetensors.index.json':65B 'moe':11A,31B,164C 'moe-checkpoint-load':30B 'omg':2A,27A,35B,45B,142C,159C 'omg-seg':1A,26A,34B,44B,141C 'onto':66B 'outsid':16A,92B 'packag':83B,94B 'path':39B,63B,74B,119B,179C 'path-travers':38B 'per':75B 'poc':122B 'problem':225C 'product':203C 'project':220C 'public':121B,195C 'python':41B 'rais':113B 'read':14A,88B 'reject':71B 'releas':127B,216C 'remot':186C 'report':77B,230C 'respond':133B,234C 'safetensor':42B,90B 'seg':3A,28A,36B,46B,143C 'shard':12A,165C 'state':56B,152C 'tensor':98B 'travers':40B,180C 'unaffect':215C 'unavail':218C 'use':199C,206C 'vendor':48B 'version':207C 'weak':135C 'weight':61B,174C 'without':70B 'write':110B 'xtuner':49B 'yet':235C","nicknames":[],"mitigations":[],"who_affected":"Teams using OMG-Seg's OMG-LLaVA/xtuner code to load DeepseekV2 MoE checkpoints with moe_implementation='shard'. Exposure needs an attacker-controlled model package (for example a downloaded checkpoint); the loader then reads a file outside the package into the model. Anyone who only loads checkpoints they built themselves, or does not use the shard MoE path, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["omgseg"],"ptokens":["omg","seg"],"labels":["high","llava","moecheckpointloader","omgseg","other","pathtraversal","python","safetensors","vendor"],"campaign_type":null,"search_a":"'-124589':22A,25A '-2026':21A,24A 'checkpoint':6A 'craft':5A 'cve':20A,23A 'file':15A 'folder':19A 'index':7A 'loader':13A 'make':9A 'model':18A 'moe':11A 'omg':2A,27A 'omg-seg':1A,26A 'outsid':16A 'read':14A 'seg':3A,28A 'shard':12A","search_b":"'absolut':73B 'checkpoint':32B,68B 'chosen':118B 'code':50B 'commit':51B 'describ':107B 'dict':57B 'directori':69B 'disk':109B 'earlier':54B 'echo':116B 'error':114B 'exist':123B 'f3b26b6':52B 'file':91B,112B 'fix':125B 'in-memori':101B 'issu':79B,106B 'join':60B 'llava':29B 'load':55B,96B 'loader':33B,87B 'maintain':130B 'make':85B 'malici':81B 'map':62B 'memori':103B 'miss':111B 'model':59B,82B,104B 'model.safetensors.index.json':65B 'moe':31B 'moe-checkpoint-load':30B 'omg':35B,45B 'omg-seg':34B,44B 'onto':66B 'outsid':92B 'packag':83B,94B 'path':39B,63B,74B,119B 'path-travers':38B 'per':75B 'poc':122B 'public':121B 'python':41B 'rais':113B 'read':88B 'reject':71B 'releas':127B 'report':77B 'respond':133B 'safetensor':42B,90B 'seg':36B,46B 'state':56B 'tensor':98B 'travers':40B 'vendor':48B 'weight':61B 'without':70B 'write':110B 'xtuner':49B","search_c":"'affect':148C,213C 'argument':173C 'attack':182C,201C 'avail':192C 'checkpoint':166C 'compon':163C 'could':197C 'dict':153C 'earli':226C 'execut':168C 'exploit':188C 'f3b26b609bae919760cd3ccf09c36179bb8624a0':146C 'file':158C 'function':150C 'identifi':138C 'inform':211C,222C 'issu':229C 'launch':185C 'lead':177C 'llava/xtuner/utils/handle_moe_load_and_save.py':160C 'load':151C 'loader':167C 'lxtgh':140C 'made':191C 'manipul':170C 'map':175C 'model':155C 'moe':164C 'omg':142C,159C 'omg-seg':141C 'path':179C 'problem':225C 'product':203C 'project':220C 'public':195C 'releas':216C 'remot':186C 'report':230C 'respond':234C 'seg':143C 'shard':165C 'state':152C 'travers':180C 'unaffect':215C 'unavail':218C 'use':199C,206C 'version':207C 'weak':135C 'weight':174C 'yet':235C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124589","severity":null,"published_at":"2026-11-09T10:17:09+00:00","modified_at":"2026-11-09T10:17:09+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124589:2266","url":"https://github.com/lxtGH/OMG-Seg/issues/78","severity":null,"published_at":"2026-11-09T10:27:11+00:00","modified_at":"2026-11-09T10:27:11+00:00","first_seen_at":"2026-11-09T10:27:11+00:00","fetched_at":"2026-11-09T10:27:11+00:00","note":"NVD + GitHub issue #78 read (via WebFetch; Exa out of credits). No fix, no maintainer reply, PoC public in the issue. Not exploited in the wild known. Nothing verified: no vendor/maintainer page. Triage said 'remote'; really requires victim to load a malicious model package.","cites":["https://github.com/lxtGH/OMG-Seg/issues/78","https://nvd.nist.gov/vuln/detail/CVE-2026-124589"]}],"documents":[{"id":106980,"url":"https://github.com/lxtGH/OMG-Seg/issues/78","title":"Path traversal in the DeepseekV2 MoE shard checkpoint loader (weight_map values joined without validation)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":106981,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124589","title":"NVD CVE-2026-124589","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}