AIKIDO-2026-136658

gluonts is vulnerable to Insecure Deserialization

Insecure Deserialization Pre-CVE Published 2 days ago

High Risk

This Affects:

gluonts

0.6.4 - 0.16.2

Fixed in 0.16.3

Are you affected? Scan for Free

TL;DR

The PyTorch predictor in gluonts.torch restores a saved model by calling torch.load on prediction-net-state.pt without setting weights_only. Because torch.load uses pickle by default, loading a maliciously crafted state file executes arbitrary code embedded in the pickle stream during unpickling. A user who deserializes an untrusted saved predictor through PyTorchPredictor.deserialize is exposed to arbitrary code execution. The fix passes weights_only=True so only tensor weights are unpickled. This fix first shipped in the 0.16.3 backport release (and is also present in 0.17.0).

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you load a PyTorch predictor saved by an untrusted or externally influenced source.