---
id: "CVE-2026-124589"
page: "https://infrastack.ai/live/CVE-2026-124589"
kind: "vulnerability"
aliases: ["CVE-2026-124589"]
title: "OMG-Seg: a crafted checkpoint index can make the MoE shard loader read files outside the model folder"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OMG-Seg", "fixed": [], "affected": "<= f3b26b609bae919760cd3ccf09c36179bb8624a0 (no versioned releases)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["llava", "moe-checkpoint-loader", "omg-seg", "other", "path-traversal", "python", "safetensors"]
not_affected_if: ["no-untrusted-checkpoints", "not-using-moe-shard"]
published_at: "2026-11-09T10:17:09+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:27:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124589", "first_seen_at": "2026-11-09T10:25:49+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124589", "first_seen_at": "2026-11-09T10:27:11+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-124589", "https://github.com/lxtGH/OMG-Seg/issues/78"]}]
exploit_sources: []
---

# OMG-Seg: a crafted checkpoint index can make the MoE shard loader read files outside the model folder

Link for people: https://infrastack.ai/live/CVE-2026-124589 (this .md is for agents)

In OMG-Seg's vendored xtuner code (commit f3b26b6 and earlier), load_state_dict_into_model() joins weight_map paths from model.safetensors.index.json onto the checkpoint directory without rejecting '..' or absolute paths. Per the reporter's issue, a malicious model package can make the loader read a safetensors file outside the package and load its tensors into the in-memory model; the issue describes no disk writes. Missing files raise errors that echo the chosen path. A public PoC exists; no fix or release, and the maintainer has not responded.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OMG-Seg affected <= f3b26b609bae919760cd3ccf09c36179bb8624a0 (no versioned releases) fixed no fixed version listed

## How to check

You are exposed if you use OMG-Seg at or before commit f3b26b609bae919760cd3ccf09c36179bb8624a0 and load DeepseekV2 MoE checkpoints with moe_implementation='shard' from sources you do not control. Open each package's model.safetensors.index.json and look for weight_map values containing '..' or starting with '/'. Check omg_llava/xtuner/utils/handle_moe_load_and_save.py for a containment check before os.path.join.

## Fix

No fix or release as of 2026-11-09; the project does not use versioning and issue #78 is open with no maintainer response. Reporter suggests rejecting absolute/'..' weight_map values and checking the resolved shard path is inside the checkpoint directory (raise ValueError). Interim: load only MoE shard checkpoints whose index you have checked by hand, and process untrusted packages in an isolated environment.

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124589
- 2026-11-09T10:27:11+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-124589 — NVD + GitHub issue #78 read (via WebFetch; Exa out of credits). No fix, no maintainer reply, PoC public in the issue. Not exploited in the wild known. Nothing verified: no vendor/maintainer page. Triage said 'remote'; really requires victim to load a malicious model package.

## Documents

- [advisory] NVD CVE-2026-124589 https://nvd.nist.gov/vuln/detail/CVE-2026-124589
- [describes] Path traversal in the DeepseekV2 MoE shard checkpoint loader (weight_map values joined without validation) https://github.com/lxtGH/OMG-Seg/issues/78

## From the sources

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_