README.md

Tensorizer torch_compat default torch.load RCE

This PoC shows that tensorizer.torch_compat.tensorizer_loading() changes the behavior of torch.load(path) in a way that bypasses the current PyTorch default weights_only=True protection.

The malicious file is generated through the Tensorizer compatibility workflow:

1. tensorizer_saving() wraps torch.save().
2. torch.save() writes Tensorizer-compatible metadata to tensorizer_torchcompat_default_rce.pt.
3. Tensorizer also creates the sidecar file tensorizer_torchcompat_default_rce.pt.tensors.
4. Loading the same file through tensorizer_loading() and plain torch.load(path) executes the malicious pickle payload.

Run:

python build_and_verify.py

Expected result:

• torch_load_default_poc: blocked by PyTorch's default weights-only guard.
• tensorizer_loading_default_poc: marker file is created.
• tensorizer_loading_weights_only_true_poc: blocked because explicit weights_only=True is incompatible with a custom pickle module.

This was tested locally only.