AIKIDO-2026-694817

TL;DR

The checkpoint recovery logic in the Checkpointer parses CKPT.yaml metadata files with PyYAML's unsafe Loader. During candidate enumeration in recover_if_possible(), any checkpoint metadata file found in the configured checkpoint path is deserialized, so metadata containing Python object construction tags instantiates arbitrary objects. Loading checkpoints from a path that contains untrusted metadata therefore leads to arbitrary code execution, even when the malicious checkpoint is never selected for recovery. The fix switches checkpoint metadata parsing to SafeLoader.