tensorizer torch_compat silent weights_only=True bypass PoC
evil_model.pt is a standard torch.save()-produced checkpoint (no .tensors
sidecar needed) containing an object whose __reduce__ returns
(os.system, ("touch /tmp/tensorizer_poc3_pwned",)).
Loading it exactly the way tensorizer's own README documents (the "Drop-In
PyTorch Compatibility Layer" example, torch.load("model.pt") — no
weights_only argument, no suppress_weights_only flag) executes the
os.system call:
import torch
from tensorizer.torch_compat import tensorizer_loading
with tensorizer_loading("model.pt.tensors", device="cpu"):
torch.load("evil_model.pt") # os.system(...) runs here
Without tensorizer_loading() active, the same file is correctly rejected by
PyTorch's weights_only=True default (torch >= 2.6):
UnpicklingError: ... Trying to load unsupported GLOBAL posix.system ....
tensorizer/torch_compat.py's _load_wrapper always injects a custom
pickle_module (_tensorizer_pickle, wrapping _TensorizerUnpickler) into
every intercepted torch.load() call. _TensorizerUnpickler only overrides
persistent_load() — it never overrides find_class() — so once the custom
pickle_module is in play, PyTorch's weights_only=True default silently
becomes ineffective for callers who didn't explicitly pass weights_only=True
themselves (and if they do pass it explicitly, torch.load raises instead —
so the only safe caller pattern is one the library's own README doesn't
demonstrate).
picklescan/modelscan both correctly flag this payload as a dangerous
posix.system global — this is not a scanner-bypass finding. The issue is
that tensorizer's own documented integration path silently removes a security
control PyTorch enabled by default, with no warning to the developer.
Reported to huntr.com as a Model File Vulnerability (MFV) submission.